Question 1

What is CyberArmy AutoFix?

Accepted Answer

AutoFix is an autonomous security remediation platform. It detects vulnerabilities, generates fixes, tests them in a live production clone, and deploys. No human intervention needed. Every fix is verified before touching production and ships with instant rollback.

Question 2

What does Never Break Prod™ mean?

Accepted Answer

Before any fix touches your real environment, AutoFix spins up an identical production clone, applies the fix, runs your full regression suite, and checks compliance. Only a verified, regression-free fix gets deployed. If anything unexpected surfaces post-deploy, rollback fires in under 60 seconds.

Question 3

What categories of risk does AutoFix cover?

Accepted Answer

AutoFix covers CVEs in OS packages, libraries, and containers; cloud/Kubernetes/IaC misconfigurations; hardcoded secrets and API keys; compliance gaps (SOC 2, PCI-DSS, HIPAA, CIS); and overprivileged IAM policies. CVE patching and package upgrades. Cloud misconfiguration remediation. Secret rotation and removal. IAM policy tightening. Compliance evidence generation

Question 4

How is AutoFix priced?

Accepted Answer

AutoFix is available via early access. Contact us to discuss pricing for your environment.

Question 5

Does AutoFix require agents or credentials?

Accepted Answer

AutoFix integrates with your existing infrastructure via read-only connectors to AWS, GCP, Azure, GitHub, Kubernetes, and your CI/CD pipeline. No persistent agents are required.

Question 6

What is a software supply chain attack?

Accepted Answer

A supply chain attack targets the packages, libraries, or tools your code depends on rather than your systems directly. Recent examples include the Axios npm attack (March 2026, affecting 100M+ weekly downloads with a remote access trojan), the Shai-Hulud worm (Sept 2025, spreading across 500+ packages and stealing cloud secrets), and the Chalk/Debug compromise (Sept 2025, 18 packages including chalk and debug hijacked via phishing, exposing 2 billion+ weekly downloads). AutoFix continuously monitors your dependency tree and auto-patches compromised packages before they reach production.

Question 7

How does AutoFix protect against supply chain attacks like the Axios npm incident?

Accepted Answer

AutoFix monitors package manifests and lockfiles continuously against live threat feeds including npm advisories, OSV, and the CVE database. When a malicious version appears — like Axios 1.14.1 and 0.30.4 in March 2026 — AutoFix detects the compromise, identifies every service that depends on it, generates a pinned upgrade to a safe version, tests in a prod clone, and deploys automatically. The entire cycle takes minutes rather than days.

Question 8

Can AutoFix detect worm-style attacks like Shai-Hulud or the Chalk/Debug compromise?

Accepted Answer

Yes. AutoFix detects version anomalies, unexpected package republications, and behavioral signatures of malicious packages. The Shai-Hulud worm (Sept 2025) self-propagated by stealing cloud secrets and republishing infected packages. The Chalk/Debug attack (Sept 2025) compromised 18 packages with 2 billion+ weekly downloads via maintainer phishing. AutoFix cross-references your dependency tree against known indicators of compromise and patches automatically.

Question 9

Is Swarm a real penetration test or just a scanner?

Accepted Answer

It's a real penetration test. Swarm AI agents actively attempt to exploit vulnerabilities. Default credentials are tried, SQL injection payloads are sent, SSRF is tested. Every finding in the report has real exploitation evidence, not theoretical risk scores.

Question 10

Will my auditor accept the Swarm report for SOC 2 or ISO 27001?

Accepted Answer

Yes. The PDF report documents scope, methodology, findings with evidence, and remediation guidance. The same structure auditors expect from a traditional pentest engagement. It's designed specifically for compliance use.

Question 11

How does domain verification work?

Accepted Answer

You add a DNS TXT record to your domain, the same way Google Search Console and Cloudflare verify ownership. This proves you have the right to authorise testing. We never scan a domain you have not verified.

Question 12

What is covered in a Swarm pentest?

Accepted Answer

Swarm tests your full external attack surface. OWASP Top 10: active exploitation. TLS/SSL weaknesses and certificate issues. DNS misconfigurations and subdomain takeover. Cloud misconfigs: S3, GCS, Azure storage. Security header gaps. Email security: SPF/DKIM/DMARC

Question 13

What's the difference between Swarm and Pentera/NodeZero?

Accepted Answer

Pentera and NodeZero start at $20K–$100K/year for enterprise security teams. Swarm targets startups and growing companies who need the same quality of testing without a six-figure budget. Same external attack surface coverage, a fraction of the cost.

Question 14

How is Swarm priced?

Accepted Answer

Swarm is in early access. Contact us to discuss pricing and get set up.

Question 15

Will a Swarm scan affect my production systems?

Accepted Answer

Scan rates are conservative and capped at 1,000 packets/second for port scanning. All exploitation attempts use standard techniques a real attacker would use, designed to find vulnerabilities rather than cause downtime.

Question 16

What data does Cyber Army collect?

Accepted Answer

For Swarm: only publicly visible information from your verified domain: DNS records, TLS metadata, HTTP headers, open port observations, and exploitation evidence. No user data or private application content. No PII from your users or application data. No data behind authentication or access controls. Evidence stored to power findings and reports

Question 17

Where is data stored and can we request residency?

Accepted Answer

Data is stored in secure cloud infrastructure with encryption in transit and at rest. US and EU residency options are available on Enterprise tiers.

Question 18

Do you support SSO and enterprise auth?

Accepted Answer

Yes. Enterprise tiers support SAML 2.0 SSO, SCIM provisioning, and role-based access control for security teams and CISO-level dashboards.

Question 19

What integrations are available?

Accepted Answer

AutoFix integrates with AWS, GCP, Azure, GitHub, GitLab, Jira, PagerDuty, Slack, and custom SIEM/SOAR platforms. Swarm exports findings to Jira and provides a full JSON API.

Question 20

How do we get started?

Accepted Answer

For Swarm: sign up, verify your domain, and your first free scan starts immediately. For AutoFix: request a demo and we will run a live proof of concept on your environment.

Question 21

What are the most common cyber threats for mid-market companies today?

Accepted Answer

The most common attack vectors against mid-market and enterprise companies: Credential theft via phishing and password reuse. Exposed secrets and API keys in code or configs. Cloud and IaC misconfigurations. Unpatched internet-facing services. Supply-chain compromise via third-party dependencies. Ransomware via flat networks and over-privileged IAM

Question 22

How do we defend against phishing and BEC?

Accepted Answer

Layer technical controls with process verification. SSO with FIDO2/passkey MFA, disable legacy auth. SPF, DKIM, DMARC enforced to reject policy. Verify wire transfers and access changes out-of-band. Password manager, blocks auto-fill on lookalike domains

Question 23

What is Zero Trust and do we need it?

Accepted Answer

Zero Trust means always verify, least privilege, assume breach. Practical starting points: SSO + phishing-resistant MFA on every service. Device posture checks before access. Network segmentation and micro-segmentation. Continuous monitoring for lateral movement

Question 24

How often should we run a penetration test?

Accepted Answer

At minimum annually and after major releases or architectural changes. With Swarm you can run continuous monthly tests, matching attacker cadence rather than annual compliance checkboxes.

Common questions.

Still have questions?