We're hosting an exclusive security leader dinner next Wednesday, for LA Tech Week. We're gathering some of the most influential security minds in SoCal who protect some of the world's largest companies for a moderated discussion on practical strategies to protect against agent swarm attacks, and how teams are using swarms today. Space is tight, apply here for our last two spots: partiful.com/e/1IfzV8OoBBcU1…

Thank gosh we were founded in 2025

Today, we're launching PR Security Reviewer, allowing teams to bring frontier security testing to every new code change. Starting today, you can: • Set up an automatic security review on every pull request • See validated findings right on the PR, before it merges • Patch issues in the same workflow your team already reviews code in Try Security Reviewer today @ mindfort.ai

Our CEO, @bveiseh, presented at OWASP LA on the state of OffSec, and why defenders need to build their own security agents. We discuss the future of security in the age of powerful offensive AI, legacy DAST, human pentesters, and more below: youtube.com/watch?v=MdPSZAcy…

MindFort maps your cloud into one attack surface graph. Connect a provider like Vercel using a team-scoped access token. The graph covers domains, DNS records, environment variables, firewall configs, users, and integrations, synced through Cartography. Switch from a grouped layout to radial or layered when you need to see the structure differently. Live in beta today.

Today, the MindFort MCP is expanding to the full spectrum of our platform. Agents can now access the full capabilities of MindFort with our MCP, from scoping a target and reviewing a finding to confirming a fix. Now, you can run the entire workflow through the way agents already work: through tool calls, without needing to touch our UI.

Today, we're announcing NexBench, our internal benchmark for measuring which models can lead an offensive-security harness, balancing validated findings, token efficiency, and cost across real-world environments. Current evals for cybersecurity have a fatal flaw: they are boxed in. Real world environments are messy, ambiguous, and contain layered vulnerabilities that can be chained together in different ways. They also have various deployment and authentication shapes, as well as various sizes which make it challenging for agents to actually navigate through. That is why we created our own eval, modeled off the thousands of real world environments we have observed our agents navigate through. Read more: mindfort.ai/research/introdu…

Coverage is live: a per-target view of every security check MindFort runs, and where it currently stands. Each check sits in one of five states: verified, failing, needs input, continuing next run, or up next. States update automatically as agents re-test targets on every assessment, so a check that passed last month can move to failing without anyone needing to touch the app. Checks are grouped by category: injection and interpreters, object authorization (IDOR), business logic and state, access control, authentication and session, crypto and secrets exposure, cloud and deployment posture, asset discovery. A single target can carry 60+ of these running at once. Failing checks link straight through to Findings for the full writeup, including how the agent got in and what to fix.

Showcasing Attack Flow Visualization: MindFort builds a graph documenting the approach and evidence captured during a test. The graph's nodes show the entry point endpoint, the intermediate steps the agent exploited, and the target state it reached. On a broken access control finding, the chain might read: exposed MCP registration endpoint, unauthenticated tool catalog access, unauthorized custom tool registered, tool catalog poisoned with attacker-controlled metadata. Zoom into a single node or expand the full graph from the finding's Attack Flow tab.

MindFort agents are able to retest and validate patched vulnerabilities. One click, and our agent re-runs the original exploit against your live target to confirm whether the fix actually held. With Retests, MindFort recreates the authenticated session the finding was originally found in, then re-attacks it directly. Nothing gets marked resolved until that exploit fails. Retest one finding, or select several on the same target and queue them together. Confirmed fixed is the only state that closes it.

MindFort supports eight different authentication flows, allowing our agents to log into a variety of applications. Most authenticated testing tools handle username and password and stop there. MindFort covers a wider range of flows by authenticating the way a real user would for each flow, giving agents the actual credential material instead of a workaround. Application Login: username and password Authenticator 2FA: username, password, and TOTP secret Email MFA: username, password, and a generated inbox for the verification code Magic Link: a generated inbox for the sign-in link SMS MFA: username, password, and a provisioned number for the code SMS Login: a provisioned number, no password API Key: bearer token, header, query param, or JSON body SSO Redirect: a test account plus the IdP and tenant Set the credential up once. Agents log in and keep testing past it.

Our billboard is up in the heart of SF!

Introducing Agentic Retests. Click retest on any finding to verify your patch actually worked. A MindFort agent dispatches to recreate the session and the vulnerability, then confirms it’s no longer exploitable. Once verified, we mark the finding resolved so you can track exactly what was fixed and when. Available to all customers starting next week.