# Report: Ethiack > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray beta report on Ethiack: Hackian (Ethiack's agentic AI pentesting engine) A– · R2 · C1 · O1; 42 provisions lit, 21 sources captured. > Page: https://gamma-ray.sgit.ai/reports/ethiack/ · Source: data/reports/ethiack.json GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet Ethiack sells an offensive security platform in which its AI agent, Hackian, maps an organisation's attack surface and tests it for exploitable vulnerabilities, alongside pentests that add human ethical hackers. 1 solution carded of 7 found 21 sources captured and hashed 42 provisions lit in 8 of 8 instruments 4 examples of the agent at work, with sources Built only from Ethiack's own public pages and, for company basics only, the news sources named beside each fact. Ethiack has not seen this report. Nothing was tested and no credentials were used. If you are Ethiack and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence. ## The agentic solutions One card per solution. Each level is computed from the evidence by a [published rule](../../spectrum/evidence-map/index.md); a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it. ### Hackian (Ethiack's agentic AI pentesting engine) AI agent that runs reconnaissance, exploits vulnerabilities with non-destructive routines and reports findings with proof of exploitation; used in Continuous Adversarial Exposure Validation and in Agentic Pentests (Swift, Depth). Hackian a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A – Autonomy not yet evidenced R2 Reach Integrated π Moderate · S1·R5·A1 ×3 C1 Control Stated π Moderate · S1·R5·A1 ×3 O1 Openness Disclosed π Moderate · S1·R5·A1 ×3 Draft Stage: Exploring (4 of 16) In production Standout. Reach 2 (Integrated): "Hackian continuously analyzes your entire attack surface in breadth" Next unlock. Autonomy 3 (Acts): public evidence that the agent handles routine tasks; the person is consulted on exceptions would get there. Trust. FACT-Ray : 12 facts: 12 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 42 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 11 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card [The full card, every answer and its evidence](../../spectrum/cards/ethiack-hackian/index.md) · [the governance layer](../../scans/ethiack-hackian/index.md) ### Continuous Adversarial Exposure Validation Always-on test mode in which Hackian runs reconnaissance and broad vulnerability checks across the in-scope attack surface. *No card yet (generally available): this solution has not been assessed.* ### Agentic Pentest (Swift, Depth) On-demand, in-depth test of selected assets by Hackian, governed by a written policy with focus, goals and guardrails. *No card yet (generally available): this solution has not been assessed.* ### Expert Pentest Hackian-led pentest with human ethical hackers, scheduled with the Ethiack team. *No card yet (generally available): this solution has not been assessed.* ### Ethiack Beacon Customer-deployed tunnel that extends Hackian's testing into internal networks. *No card yet (generally available): this solution has not been assessed.* ### Attack Surface Management Continuous discovery and mapping of an organisation's assets. *No card yet (generally available): this solution has not been assessed.* ### Ethiack Zero Public, read-only feed of new vulnerabilities with Ethiack's check and exploit timings, over a REST API and a public MCP server. *No card yet (public, free): this solution has not been assessed.* ## Our reading **The shape.** Hackian, Ethiack's agentic AI pentesting engine, reads A– · R2 · C1 · O1 (Exploring), and every level holds as shipped. It runs reconnaissance across a customer's in-scope attack surface, confirms vulnerabilities with non-destructive exploitation routines and reports findings with proof. Once launched, an Agentic Pentest runs on its own, deciding in real time within the policy and scope the customer writes; findings and an activity log show its progress. **Where the evidence is strongest.** Named customers on Ethiack's own pages, with the company's figures: Universidade do Porto, where Hackian runs continuously on 1,000 critical assets within 5,000; Jumia, with more than 2,600 assets tested; and CEGID, with more than 2,000. The controls a customer has are documented: guardrails written in prose in the test policy, a control to pause or restart a continuous test, an activity log on each test page, and the right to change the severity of a finding and comment on it. **Seen, and not counted yet.** Ethiack publishes benchmark results for Hackian against other agents under its EthiBench protocol, with public targets and ground truth, three runs and statistical tests. That meets the rule for Openness 3, but Openness is cumulative and level 2 is not yet evidenced, so the card reads Openness 1 until it is. The challenger also lowered a grey-box credentials page offered as a description of data, a contract clause offered as incident communication, and a target list offered as narrower access: each is a different thing. **What would move it.** Autonomy 3: a public page saying how a person takes part while Hackian acts (consulted on exceptions, approving critical decisions, or monitoring within boundaries); the documentation already shows Hackian acting. Openness 2: a page saying what data Hackian processes, keeps or learns from, and under what rules; the docs already name what it does not yet cover alone, such as mobile applications, and the published evaluations would then count. Control 2: a page stating which actions wait for a person's approval and listing what Hackian may reach. Reach: the next unlock the rules name is level 4, others building on Hackian across organisations; the MCP server Ethiack has announced, for outside agents to query findings and trigger tests, is seen and not counted until it is published. **For readers.** Ethiack, S.A. is seated at Instituto Pedro Nunes in Coimbra and dates itself to 2022. The marketing figures on the Hackian page, such as the share of PortSwigger labs solved, carry no method and are not counted; the EthiBench results carry one. ## What would move it The one piece of public evidence that would lift each card next: - **Hackian (Ethiack's agentic AI pentesting engine)**: Autonomy 3 (Acts). Public evidence that the agent handles routine tasks; the person is consulted on exceptions. ## The agent at work Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown. ### Universidade do Porto Hackian runs continuous testing against the university's external exposure; 1,000 critical assets within 5,000. "Hackian, our agentic AI pentester, runs against U.Porto's exposure 24/7" [Source](https://ethiack.com/info-hub/case-studies/scaling-security-how-uporto-and-ethiack-protected-5000-assets-with-ai-powered-intelligence) (captured 2026-11-10T19:44Z, sha256 `5b34d184cb10e624`) ### Jumia Hackian runs autonomous pentesting across Jumia's external attack surface; more than 2,600 assets tested. "Today Ethiack tests more than 2,600 of its assets." [Source](https://ethiack.com/info-hub/case-studies/jumia-continuous-validation) (captured 2026-11-10T10:40Z, sha256 `9b8276384a326313`) ### CEGID Hackian runs continuous pentesting against more than 2,000 exposed assets across the group. "Hackian runs continuous, autonomous pentesting against more than 2,000 exposed assets" [Source](https://ethiack.com/info-hub/case-studies/from-checklist-based-pentesting-to-autonomous-ethical-hacking-what-changed-for-cegid) (captured 2026-11-10T10:40Z, sha256 `f67604fe918663c6`) ### ANA Aeroportos Continuous automated penetration testing of ANA's external attack surface, plus human testing of internal systems. "24/7 automated penetration testing to identify vulnerabilities in ANA’s external attack surface" [Source](https://ethiack.com/info-hub/case-studies/strengthening-cybersecurity-at-ana-aeroportos-with-ethiacks-ethical-hacking) (captured 2026-11-10T10:40Z, sha256 `88229413807b0fed`) ## The company - Founding year in the site's structured data ""foundingDate":"2022"" [Source](https://ethiack.com/) (captured 2026-11-10T10:40Z, sha256 `61691836f51346e6`) - Founding location in the site's structured data ""name":"Coimbra, Portugal"" [Source](https://ethiack.com/) (captured 2026-11-10T10:40Z, sha256 `61691836f51346e6`) - Legal entity and seat named in the Security Policy "Ethiack, S.A (Instituto Pedro Nunes, Coimbra)" [Source](https://ethiack.com/legal/security-policy) (captured 2026-11-10T10:40Z, sha256 `f0b655c59c8ae51d`) - The About page dates the company to 2022 "In 2022, Ethiack was born to rethink how security is done" [Source](https://ethiack.com/about) (captured 2026-11-10T10:40Z, sha256 `a6b212b51f8a2e09`) - Hackian is the name of the agent and the engine "Hackian, our agentic AI pentesting engine." [Source](https://ethiack.com/) (captured 2026-11-10T10:40Z, sha256 `61691836f51346e6`) - The documentation calls it the Ethiack Hackian Engine "The Ethiack Beacon securely extends the Ethiack Hackian Engine testing capabilities" [Source](https://docs.ethiack.com/docs/portal/surface/configuring-your-beacon) (captured 2026-11-10T19:44Z, sha256 `84c79566bf725c01`) - Three test types are offered; Continuous and Agentic Pentests are run by Hackian "Ethiack offers three distinct test types" [Source](https://docs.ethiack.com/docs/portal/tests) (captured 2026-11-10T10:40Z, sha256 `2acbdf55463b1b0f`) - Terms of Service state compliance with the EU AI Act where applicable "fully compliant with the provisions of the Artificial Intelligence Act (AI Act)" [Source](https://ethiack.com/legal/terms-of-service) (captured 2026-11-10T10:40Z, sha256 `0c9e1d67f12a596d`) - Pricing lists on-demand pentests and a continuous plan "Bundles and customized pentests available" [Source](https://ethiack.com/pricing) (captured 2026-11-10T10:40Z, sha256 `4ffe2c84147cfcbd`) ## The people Public and professional only, from the company's own pages or a public professional source. - **Jorge Monteiro**, Co-Founder and CEO. [Source](https://ethiack.com/) - **André Baptista**, Co-Founder and CTO. [Source](https://ethiack.com/) - **Vítor Pinho**, CCSO. [Source](https://ethiack.com/) - **João Ferreira**, Head of Product. [Source](https://ethiack.com/info-hub/product/spring-release-2026) ## The graph The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies". people and stories company solutions 11 sources 12 indicators 42 provisions, by instrument I08: Hackian runs exploitation routines itself to confirm vulnerabilities. I10: In continuous mode Hackian works across the whole in-scope attack surface, not one system. I11: With a Beacon deployed by the customer, Hackian reaches into the customer's internal networks over a tunnel. I20: The documentation states what an Agentic Pentest by Hackian is for. I22: The documentation states a scope limit: test types Hackian does not handle on its own, such as mobile applications, go to human testers. I39: A continuous test page has a control to pause or restart the test; the page gives it for continuous tests only. I41: Each test page carries an activity log of the actions Hackian performs. I47: The customer writes guardrails in the test policy, in prose, stating what the agent must not do. I50: Ethiack publishes its own run of Hackian against other agents under EthiBench, a protocol published on arXiv; the post says Hackian is not in the paper itself. I57: Customers open tickets about the Ethiack platform in its Support Portal, with steps to reproduce and the unexpected outcome; the page does not name Hackian or its findings. S1: A named customer, Universidade do Porto, runs Hackian continuously against its external exposure. S3: The documentation site publishes an llms.txt that resolves and indexes the portal, API and test documentation. Ethiack Jorge Monteiro André Baptista Vítor Pinho João Ferreira Universidade do Porto Jumia CEGID ANA Aeroportos Hackian (Ethiack's agentic AI pentesting engine) Hackian A– · R2 · C1 · O1 Continuous Adversarial Exposure Validation Continuous Validation Agentic Pentest (Swift, Depth) Agentic Pentest Expert Pentest Expert Pentest Ethiack Beacon Ethiack Beacon Attack Surface Management Attack Surface Management Ethiack Zero Ethiack Zero ethiack.com/hackian docs.ethiack.com/docs/portal/test… docs.ethiack.com/docs/portal/surf… docs.ethiack.com/docs/portal/test… docs.ethiack.com/docs/portal/test… docs.ethiack.com/docs/portal/test… docs.ethiack.com/docs/portal/test… ethiack.com/info-hub/research/ai-… docs.ethiack.com/docs/general/sup… ethiack.com/info-hub/case-studies… docs.ethiack.com/llms.txt It executes actions itself I08 It works across several domains or systems I10 It connects to external tools or services across a trust boundary I11 Its purpose and permitted tasks are stated in writing I20 Its limits and known failure cases are documented for those who use it I22 There is a way to pause or stop it I39 Its actions are logged I41 A limit on it is a rule in prose I47 Test or evaluation results are published I50 There is a channel to report problems with it or contest its output I57 It is in production: a public source names a customer or gives usage figures for what it does on its own S1 It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card S3 Salesforce 8 EAAMM 1 OWASP 5 MCP authorization 2 AAGMM 2 Microsoft 4 NIST AI RMF 16 EU AI Act 4 Salesforce, Level 2: Simple Orchestration, Single Domain Salesforce, Level 1, how to advance from Level 1 to Level 2 Microsoft, 200: Repeatable, Business strategy Salesforce, Level 3: Complex Orchestration, Multiple Domain Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 Microsoft, 400: Capable, Business strategy Microsoft, 200: Repeatable, Technology and data OWASP, AT6 Externally Extended Agent NIST AI RMF, GOVERN 6.1 NIST AI RMF, MAP 4.1 NIST AI RMF, MAP 1.1 NIST AI RMF, MAP 2.1 NIST AI RMF, MAP 3.3 NIST AI RMF, MAP 1.3 EU AI Act, Article 13 NIST AI RMF, MAP 2.2 NIST AI RMF, MEASURE 2.5 OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action NIST AI RMF, MANAGE 2.4 EU AI Act, Article 14 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action EU AI Act, Article 12 AAGMM, GD-03 AAGMM, GD-08 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action NIST AI RMF, MEASURE 2.1 NIST AI RMF, MEASURE 2.3 EAAMM, Prerequisite, L2 to L3 EU AI Act, Article 15 NIST AI RMF, MEASURE 1.1 NIST AI RMF, MEASURE 3.3 NIST AI RMF, GOVERN 5.1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 4, how to maximize value NIST AI RMF, GOVERN 5.2 NIST AI RMF, MAP 1.4 Microsoft, 400: Capable, Business strategy Salesforce, Level 0, how companies can advance from Level 0 to Level 1 MCP authorization, Authorization (draft) MCP authorization, Authorization (draft) ## The evidence | Source | Read | SHA-256 (first 16) | |---|---|---| | [docs.ethiack.com/docs/general/support-portal](https://docs.ethiack.com/docs/general/support-portal) | 2026-11-10T19:44Z | `96be5f44d0d7b2bf` | | [docs.ethiack.com/docs/portal/surface/configuring-your-beacon](https://docs.ethiack.com/docs/portal/surface/configuring-your-beacon) | 2026-11-10T19:44Z | `84c79566bf725c01` | | [docs.ethiack.com/docs/portal/tests](https://docs.ethiack.com/docs/portal/tests) | 2026-11-10T10:40Z | `2acbdf55463b1b0f` | | [docs.ethiack.com/docs/portal/tests/agentic-pentest-policy-guidelines](https://docs.ethiack.com/docs/portal/tests/agentic-pentest-policy-guidelines) | 2026-11-10T19:44Z | `544cfd92b23d9220` | | [docs.ethiack.com/docs/portal/tests/agentic-pentests](https://docs.ethiack.com/docs/portal/tests/agentic-pentests) | 2026-11-10T19:44Z | `fcb64787931f25ed` | | [docs.ethiack.com/docs/portal/tests/continuous-adversarial-exposure-val](https://docs.ethiack.com/docs/portal/tests/continuous-adversarial-exposure-validation) | 2026-11-10T19:44Z | `ee80814e6e113dc5` | | [docs.ethiack.com/docs/portal/tests/human-in-the-loop](https://docs.ethiack.com/docs/portal/tests/human-in-the-loop) | 2026-11-10T19:44Z | `73a997c1b8b3e142` | | [docs.ethiack.com/docs/portal/tests/test-details](https://docs.ethiack.com/docs/portal/tests/test-details) | 2026-11-10T19:44Z | `ae280c9d1654ffba` | | [docs.ethiack.com/llms.txt](https://docs.ethiack.com/llms.txt) | 2026-11-10T19:44Z | `f0f352298b06ae2a` | | [ethiack.com/](https://ethiack.com/) | 2026-11-10T10:40Z | `61691836f51346e6` | | [ethiack.com/about](https://ethiack.com/about) | 2026-11-10T10:40Z | `a6b212b51f8a2e09` | | [ethiack.com/hackian](https://ethiack.com/hackian) | 2026-11-10T19:44Z | `5f4cecee0abc3d7a` | | [ethiack.com/info-hub/case-studies/from-checklist-based-pentesting-to-a](https://ethiack.com/info-hub/case-studies/from-checklist-based-pentesting-to-autonomous-ethical-hacking-what-changed-for-cegid) | 2026-11-10T10:40Z | `f67604fe918663c6` | | [ethiack.com/info-hub/case-studies/jumia-continuous-validation](https://ethiack.com/info-hub/case-studies/jumia-continuous-validation) | 2026-11-10T10:40Z | `9b8276384a326313` | | [ethiack.com/info-hub/case-studies/scaling-security-how-uporto-and-ethi](https://ethiack.com/info-hub/case-studies/scaling-security-how-uporto-and-ethiack-protected-5000-assets-with-ai-powered-intelligence) | 2026-11-10T19:44Z | `5b34d184cb10e624` | | [ethiack.com/info-hub/case-studies/strengthening-cybersecurity-at-ana-a](https://ethiack.com/info-hub/case-studies/strengthening-cybersecurity-at-ana-aeroportos-with-ethiacks-ethical-hacking) | 2026-11-10T10:40Z | `88229413807b0fed` | | [ethiack.com/info-hub/product/spring-release-2026](https://ethiack.com/info-hub/product/spring-release-2026) | 2026-11-10T10:40Z | `0f29d0bb2dd28ebd` | | [ethiack.com/info-hub/research/ai-pentesting-benchmarks-are-so-bad-we-m](https://ethiack.com/info-hub/research/ai-pentesting-benchmarks-are-so-bad-we-made-a-new-one) | 2026-11-10T19:44Z | `a80896db5705974d` | | [ethiack.com/legal/security-policy](https://ethiack.com/legal/security-policy) | 2026-11-10T10:40Z | `f0b655c59c8ae51d` | | [ethiack.com/legal/terms-of-service](https://ethiack.com/legal/terms-of-service) | 2026-11-10T10:40Z | `0c9e1d67f12a596d` | | [ethiack.com/pricing](https://ethiack.com/pricing) | 2026-11-10T10:40Z | `4ffe2c84147cfcbd` | ## How this report was made A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The [deterministic scorer](../../spectrum/pipeline/index.md) computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); Hackian (Ethiack's agentic AI pentesting engine): reviewed in 6 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-11. A person's sign-off of the series is still to come. | Role | Who | |---|---| | researcher-assessor | a sub-agent of gamma.studio@web-summit.dinis | | challenger | a sub-agent | | scorer | build/spectrum.mjs | | analyst, designer, writer | gamma.studio@web-summit.dinis | | review | gamma.review@web-summit.dinis, 6 rounds | | sign-off | gamma.approve@web-summit.dinis, 2026-11-11 | ## The vault Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (`1livflie`). Read key: sgit_public_read_d255aac8826ac0704c9059943a1f331cabf3993405f156516329cc8d239d97fd:1livflie With [sgit](https://sgit.ai/): `sgit clone` followed by the key. The key reads; it cannot write. ## Corrections None yet. A correction is made in place, dated here, and carried to the card, the vault and the article. ## The article [Hackian on the GAMMA-Ray Spectrum: A– · R2 · C1 · O1](article.md), written from this report for PrompTugal.news.