Classic penetration test
1 ×
annual time window · manual effort
- Snapshot instead of trend view
- Hard to reproduce between audits
- Findings go stale between tests
Validate security regularly. AI-orchestrated
The RedMentis pentest platform makes security testing more repeatable and reveals attack paths in context, as a complement to classic penetration tests. For IT security leads in public authorities and mid-sized companies who need evidence for management. Today we run RedMentis in pilot operation with selected customers, as a service delivered by GAD.
GAD is certified to ISO/IEC 27001:2022 (No. 26052601). More on security & compliance
RedMentis at a glance
See how RedMentis validates
A language model only estimates your security posture. RedMentis actually tests it, repeatably and with evidence.
·HOW IT WORKS
AI-orchestrated validation, step by step
An AI-assisted decision logic models possible attack paths, evaluates intermediate results and prioritizes risks in context.
- 01
Scope & environment
Defined scope, written authorization, clear rules of engagement
- 02
Path modeling
AI-assisted modeling of possible attack paths across identities, configurations and interfaces
- 03
Controlled validation
Tests run repeatably and under control within the agreed scope. Intermediate results are evaluated and prioritized
- 04
Two-level reporting
Technical findings with remediation, management reports with clear context
Start: scope authorized in writingResult: validated paths, measures, report
·SECURITY FRAMEWORK
In pilot operation, every test run starts only after your written approval and stays within the agreed scope. Planned for the further build-out of the platform:
- Role-based access, planned. Every action is to be tied to a role, every access logged.
- Compliance mapping, planned. Findings are to be mapped to ISO 27001, NIS 2 and the EU AI Act, so they can be used as audit evidence.
·THE PLATFORM IN ACTION
Attack paths, findings and remediation in one interface
This is what a validation run in RedMentis looks like: one score for the overall state, the attack paths found, the findings by severity and the measures that close a path.
DemoInteractive demo view with sample data. Click through overview, attack paths, findings and remediation.
RedMentis
Run 14 · Scope: internal network, web applications, cloudSample data, no customer data
Overview run 14
Validation score
76
Open attack paths
3
Findings
18
Closed since run 13
5
Score over the last five runs
Most critical path
Phishing emailWorkstationAdmin accountCustomer database
Severity
Recommended measure
MFA for admin accounts
If this measure closes the path, the next run confirms it.
Attack paths
Paths found within the agreed scope
P-01 · Target: customer database
CriticalPhishing emailWorkstationAdmin accountCustomer database
4 steps · confirmed in run 14
P-02 · Target: cloud storage
HighContact formCustomer APICloud storage
3 steps · confirmed in run 14
P-03 · Target: file server
MediumVPN accessFile server
2 steps · new in run 14
P-04 · Target: accounting
ClosedGuest Wi-FiPrinterAccounting
no longer reachable since run 13
Findings by severity
Latest findings
No MFA for privileged accounts
Identities · part of P-01
Local admin password reused
Workstation · part of P-01
Customer API without rate limit
Web/API · part of P-02
Outdated VPN version
Network · part of P-03
Distribution
Each finding appears with its attack path, not in a loose list.
Remediation plan
Measures by impact
Enforce MFA for admin accounts
closes P-01 · low effort
Unique local admin password per device
breaks P-01 · medium effort
Add a rate limit to the customer API
closes P-02 · confirmed in run 14
Update the VPN gateway
closes P-03 · low effort
After each measure, the next run checks whether the path is closed.
Findings by standard (planned)
ISO 27001
NIS 2
EU AI Act
·THE PROBLEM
Classic pentests are point-in-time snapshots
If a penetration test is only done once a year, the time in between stays untested. RedMentis makes that time testable, without replacing the classic pentest.
AI-orchestrated validation
regular
repeatable · controlled · automated
- Repeated validation with every test run
- Reproducible with the same scope
- Path analysis instead of isolated findings
Questions? Answers
What exactly is RedMentis?
An AI-orchestrated security validation. RedMentis does not just take a snapshot, it looks at weaknesses in the context of possible attack paths and makes that check repeatable. Today we run RedMentis in pilot operation with selected customers, as a service delivered by GAD.
Does RedMentis replace a classic penetration test?
No. RedMentis complements the classic pentest, it does not replace it. The value lies in repeatable checks between audit cycles and in the view of connected attack paths instead of isolated findings.
Where and how do the tests run?
Against the scope we define with you in writing beforehand, for example externally reachable systems, internal network, web applications or cloud. Tests run under control and only with your authorization. They are designed not to modify production systems, any exceptions are agreed with you in writing beforehand. Before the first run you approve the target systems in writing. Without this approval, the access would be a criminal offense under German law (Sections 202a to 202c StGB). If systems belong to a hosting provider, cloud provider or IT service provider, you also obtain their consent beforehand where required.
Which standards does RedMentis map findings to?
A fixed mapping of findings to ISO 27001, NIS 2 and the EU AI Act is planned, it is not yet part of the pilot operation.
How do we use RedMentis?
In the pilot as a service delivered by GAD: our team runs the validation with RedMentis and reviews the findings with you. We agree scope, environment and goals up front. A license that lets your team run the tests itself is planned.
Get to know RedMentis
We show you RedMentis in a demo and work out whether a pilot fits your environment.