Ethiack

GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet

Ethiack sells an offensive security platform in which its AI agent, Hackian, maps an organisation's attack surface and tests it for exploitable vulnerabilities, alongside pentests that add human ethical hackers.

Built only from Ethiack's own public pages and, for company basics only, the news sources named beside each fact. Ethiack has not seen this report. Nothing was tested and no credentials were used. If you are Ethiack and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence.

The agentic solutions

One card per solution. Each level is computed from the evidence by a published rule; a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it.

Hackian (Ethiack's agentic AI pentesting engine)

AI agent that runs reconnaissance, exploits vulnerabilities with non-destructive routines and reports findings with proof of exploitation; used in Continuous Adversarial Exposure Validation and in Agentic Pentests (Swift, Depth).

The full card, every answer and its evidence · the governance layer

Continuous Adversarial Exposure Validation

Always-on test mode in which Hackian runs reconnaissance and broad vulnerability checks across the in-scope attack surface. No card yet (generally available): this solution has not been assessed.

Agentic Pentest (Swift, Depth)

On-demand, in-depth test of selected assets by Hackian, governed by a written policy with focus, goals and guardrails. No card yet (generally available): this solution has not been assessed.

Expert Pentest

Hackian-led pentest with human ethical hackers, scheduled with the Ethiack team. No card yet (generally available): this solution has not been assessed.

Ethiack Beacon

Customer-deployed tunnel that extends Hackian's testing into internal networks. No card yet (generally available): this solution has not been assessed.

Attack Surface Management

Continuous discovery and mapping of an organisation's assets. No card yet (generally available): this solution has not been assessed.

Ethiack Zero

Public, read-only feed of new vulnerabilities with Ethiack's check and exploit timings, over a REST API and a public MCP server. No card yet (public, free): this solution has not been assessed.

Our reading

The shape. Hackian, Ethiack's agentic AI pentesting engine, reads A– · R2 · C1 · O1 (Exploring), and every level holds as shipped. It runs reconnaissance across a customer's in-scope attack surface, confirms vulnerabilities with non-destructive exploitation routines and reports findings with proof. Once launched, an Agentic Pentest runs on its own, deciding in real time within the policy and scope the customer writes; findings and an activity log show its progress.

Where the evidence is strongest. Named customers on Ethiack's own pages, with the company's figures: Universidade do Porto, where Hackian runs continuously on 1,000 critical assets within 5,000; Jumia, with more than 2,600 assets tested; and CEGID, with more than 2,000. The controls a customer has are documented: guardrails written in prose in the test policy, a control to pause or restart a continuous test, an activity log on each test page, and the right to change the severity of a finding and comment on it.

Seen, and not counted yet. Ethiack publishes benchmark results for Hackian against other agents under its EthiBench protocol, with public targets and ground truth, three runs and statistical tests. That meets the rule for Openness 3, but Openness is cumulative and level 2 is not yet evidenced, so the card reads Openness 1 until it is. The challenger also lowered a grey-box credentials page offered as a description of data, a contract clause offered as incident communication, and a target list offered as narrower access: each is a different thing.

What would move it. Autonomy 3: a public page saying how a person takes part while Hackian acts (consulted on exceptions, approving critical decisions, or monitoring within boundaries); the documentation already shows Hackian acting. Openness 2: a page saying what data Hackian processes, keeps or learns from, and under what rules; the docs already name what it does not yet cover alone, such as mobile applications, and the published evaluations would then count. Control 2: a page stating which actions wait for a person's approval and listing what Hackian may reach. Reach: the next unlock the rules name is level 4, others building on Hackian across organisations; the MCP server Ethiack has announced, for outside agents to query findings and trigger tests, is seen and not counted until it is published.

For readers. Ethiack, S.A. is seated at Instituto Pedro Nunes in Coimbra and dates itself to 2022. The marketing figures on the Hackian page, such as the share of PortSwigger labs solved, carry no method and are not counted; the EthiBench results carry one.

What would move it

The one piece of public evidence that would lift each card next:

• Hackian (Ethiack's agentic AI pentesting engine): Autonomy 3 (Acts). Public evidence that the agent handles routine tasks; the person is consulted on exceptions.

The agent at work

Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown.

Universidade do Porto

Hackian runs continuous testing against the university's external exposure; 1,000 critical assets within 5,000. "Hackian, our agentic AI pentester, runs against U.Porto's exposure 24/7"

Source (captured 2026-11-10T19:44Z, sha256 5b34d184cb10e624)

Jumia

Hackian runs autonomous pentesting across Jumia's external attack surface; more than 2,600 assets tested. "Today Ethiack tests more than 2,600 of its assets."

Source (captured 2026-11-10T10:40Z, sha256 9b8276384a326313)

CEGID

Hackian runs continuous pentesting against more than 2,000 exposed assets across the group. "Hackian runs continuous, autonomous pentesting against more than 2,000 exposed assets"

Source (captured 2026-11-10T10:40Z, sha256 f67604fe918663c6)

ANA Aeroportos

Continuous automated penetration testing of ANA's external attack surface, plus human testing of internal systems. "24/7 automated penetration testing to identify vulnerabilities in ANA’s external attack surface"

Source (captured 2026-11-10T10:40Z, sha256 88229413807b0fed)

The company

• Founding year in the site's structured data ""foundingDate":"2022"" Source (captured 2026-11-10T10:40Z, sha256 61691836f51346e6)
• Founding location in the site's structured data ""name":"Coimbra, Portugal"" Source (captured 2026-11-10T10:40Z, sha256 61691836f51346e6)
• Legal entity and seat named in the Security Policy "Ethiack, S.A (Instituto Pedro Nunes, Coimbra)" Source (captured 2026-11-10T10:40Z, sha256 f0b655c59c8ae51d)
• The About page dates the company to 2022 "In 2022, Ethiack was born to rethink how security is done" Source (captured 2026-11-10T10:40Z, sha256 a6b212b51f8a2e09)
• Hackian is the name of the agent and the engine "Hackian, our agentic AI pentesting engine." Source (captured 2026-11-10T10:40Z, sha256 61691836f51346e6)
• The documentation calls it the Ethiack Hackian Engine "The Ethiack Beacon securely extends the Ethiack Hackian Engine testing capabilities" Source (captured 2026-11-10T19:44Z, sha256 84c79566bf725c01)
• Three test types are offered; Continuous and Agentic Pentests are run by Hackian "Ethiack offers three distinct test types" Source (captured 2026-11-10T10:40Z, sha256 2acbdf55463b1b0f)
• Terms of Service state compliance with the EU AI Act where applicable "fully compliant with the provisions of the Artificial Intelligence Act (AI Act)" Source (captured 2026-11-10T10:40Z, sha256 0c9e1d67f12a596d)
• Pricing lists on-demand pentests and a continuous plan "Bundles and customized pentests available" Source (captured 2026-11-10T10:40Z, sha256 4ffe2c84147cfcbd)

The people

Public and professional only, from the company's own pages or a public professional source.

• Jorge Monteiro, Co-Founder and CEO. Source
• André Baptista, Co-Founder and CTO. Source
• Vítor Pinho, CCSO. Source
• João Ferreira, Head of Product. Source

The graph

The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies".

The evidence

How this report was made

A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The deterministic scorer computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); Hackian (Ethiack's agentic AI pentesting engine): reviewed in 6 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-11. A person's sign-off of the series is still to come.

The vault

Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (1livflie). Read key:

sgit_public_read_d255aac8826ac0704c9059943a1f331cabf3993405f156516329cc8d239d97fd:1livflie

With sgit: sgit clone followed by the key. The key reads; it cannot write.

Corrections

None yet. A correction is made in place, dated here, and carried to the card, the vault and the article.

The article

Hackian on the GAMMA-Ray Spectrum: A– · R2 · C1 · O1, written from this report for PrompTugal.news.