We break systemson purpose.
An independent security lab in Australia. Penetration testing as a service by researchers credited with CVEs in Apple and GitLab, plus an autonomous engine that keeps testing between engagements.
Offensive work, reported precisely.
All services →Research we disclosed, then documented.
All eight advisories →How an engagement runs
Pentesting as a service,scoped like an engineer would.
Senior researchers only. Fixed scope and fixed price after a short call. Retests and an attestation letter are included in every engagement.
Autonomous pentesting,verified by humans.
In private beta, with the waitlist open. An AI agent built on the way our researchers actually work: enumerate, hypothesise, exploit, prove. It runs continuously against staging or production-mirror environments and produces findings with working proof-of-concept, reviewed by a CoreVanta researcher before you see them.
How a run works
Not a scanner. Here's the difference.
| Vulnerability scanner | CoreVanta Autonomous |
|---|
Guardrails first
Scope is enforced at the network layer, not by prompt. Destructive actions are off by default and require human approval. Every action is logged and replayable.
Fits your pipeline
Trigger a run from CI on every deploy, or on a schedule. Findings land in GitHub, GitLab, Jira or Slack with the proof-of-concept attached.
A human signs every report
No finding reaches you without a researcher confirming the exploit, rating it and writing the fix guidance. False positives are our problem, not yours.
Research first.Services fund it.
The lab pulls apart web applications, reverses binaries never meant to be read, and maps what the open internet already knows about a target. Every engagement inherits what the last experiment taught. Eight credited CVEs so far, all disclosed responsibly.
A small lab thatpublishes what it finds.
CoreVanta Security is an independent offensive-security lab based in Australia. We run engagements for product teams who need a straight answer about where they stand, and spend the rest of our time on vulnerability research against the software everyone depends on.
Senior-only delivery
The person who scopes your engagement is the person who tests it and writes the report. No hand-offs to juniors, no templated findings.
Responsible disclosure
Every vulnerability we find in third-party software goes to the vendor first, with a 90-day window before we publish. Eight CVEs and counting, across Apple and GitLab.
Research feeds the product
Techniques from the lab become test cases in our autonomous engine, so the agent gets sharper with every advisory, not just every release.
CP TECH SOLUTIONS PTY LTD
trading as CoreVanta Security
66 655 283 668
Australia, engagements worldwide
GitLab via HackerOne · Apple Product Security
Tell usthe shape of it.
A researcher reads every request. You'll get a written scope and fixed price within two business days, and no sales call unless you want one.
Got it, .
Your mail client should have opened with the request. If it didn't, email jay@corevantasecurity.com directly. A researcher will reply to with a written scope and fixed price within two business days.