Chadow runs authorized engagements end to end — recon, scanning, exploitation and a written report — against targets you own. Findings land in one workspace with the evidence attached and the steps to reproduce them.
Authorized targets only. Scope is confirmed before anything runs.
See it run
Pick a surface. Cortex drives the target like a user, watches what it says on the wire and reads what it leaves behind — and reasons about what it sees. This is the shape of a real run.
shop-android-4.2.1.apk
Simulated walkthroughExample findings, not a real engagement.
Nothing yet.
Findings shown are illustrative. On your own target, each one arrives with the evidence attached and the steps to reproduce it.
What it does
Five modules in one workspace: two that run engagements, two that keep watching, and one you can ask.
Application scanning
Points real offensive tooling at one application and writes up what it finds, with the evidence attached. It takes more than a URL:
Offensive simulation
Plans and runs a full engagement against an authorized target — recon, exploitation, chaining what works — and writes up what it found, with the evidence in the report.
Credential exposure
Watches breach and credential-dump data for the domains and addresses a workspace has verified, and flags the matches.
CVE intelligence
A local, filterable mirror of the public CVE feed — searchable against the software you actually run, without leaving the workspace.
Security assistant
A chat assistant with this workspace’s scans and findings in context — for triage, follow-up questions and drafting the write-up.
Cortex and Apex spend real compute against real infrastructure. They run only against targets a workspace has added and confirmed it is authorized to test, and a run takes as long as the work takes.
How it works
Name the domain, app or asset you are authorized to test and confirm its scope. Nothing is deployed and no agent is installed.
Watch either one work — Cortex shows its reasoning and every action it takes; Apex shows its plan, its agents, the pages it captures and the commands it runs.
Findings land in the workspace ranked by severity, each with its evidence and the steps to reproduce it, and a report you can hand to whoever fixes it.
Pricing
What Chadow costs depends on how much surface you point it at.
$299/mo
Save 17% billed yearly
Essential features for individuals.
Up to 3 seats
$999/mo
Save 17% billed yearly
Advanced features for professionals.
Up to 6 seats
$1,999/mo
Save 17% billed yearly
For teams and growing businesses.
Up to 15 seats
Custom
Priced to your scope
Full access for organizations.
Up to 100 seats
Want to look around first? Create an account — or sign in if you already have one.
These are extras on an existing subscription, not the price of Chadow. Each is bought one at a time, stacks on top of a base plan, and stays valid until that subscription ends.
Talk to us
Thirty minutes with an engineer, run against something you own.
One call. We launch a scan against a target you nominate and stay on the line while it runs.
Nothing is touched until you have confirmed, in writing, what we may test. Authorized targets only — that is the whole basis this works on.
The findings and the written report are yours at the end of the call, whether or not you go further.
We confirm your email and phone with a one-time code so a booking reaches a real person. Both are used for this booking and to reach you about it — two messages in total, and no marketing list.
Thirty minutes, against a target you own. We agree scope before anything runs.
Point Chadow at something you own and let it do the recon, the scanning, the exploitation and the write-up. You decide what gets fixed.
