01
Mobile App
Field control surface
The operator's hands-on-target interface: run tools, watch standpoint state change in real time, pull findings straight into the engagement record, all from the field where the actual work happens.
Early access now open
Test everything. Anywhere.
Through anything.
PoneY is the offensive security control plane: one system covering network & service infrastructure, cloud, and web & mobile applications, reachable from your phone, the dashboard, or your desktop, with the same engagement always in sync across all three. Connect however the job calls for it: pivot agent, VPN, or SSH, and keep testing without juggling pivots or reinstalling a thing.
Built by practitioners, for practitioners. No installers. No dependency roulette.
nmap/
masscan/
BloodHound/
Kerberoasting/
Impacket/
hashcat/
hcxdumptool/
aircrack-ng/
bettercap/
Responder/
Certipy/
NetExec/
Pacu/
ScoutSuite/
ROADtools/
Proxmark3/
Flipper Zero/
Frida/
MobSF/
WSTG/
MASTG/
// the real cost
Your skills aren't the bottleneck. Your toolkit is.
Every operator knows the tax: before you can even start an engagement, you're collecting scattered shards of scripts from a dozen repos, resolving broken dependencies, patching a tool that hasn't been touched in a year, and double-checking your arsenal is actually complete. Again, before the client call, mid-engagement when the scope shifts, and after, when you're proving what you actually ran. And sometimes, after all that, the tool the job genuinely needs isn't there at all.
01
Scattered arsenal
Scripts and tools spread across repos, VMs, USB sticks, and half-remembered gists. Nothing lives in one place.
02
Dependency roulette
Every tool drags its own Python version, its own package hell, its own broken install day. Every. Single. Time.
03
Constant inventory
Babysitting your own kit before, during, and after an engagement just to confirm nothing needed is missing.
04
The tool that isn't there
Sometimes what the job needs simply doesn't exist yet, and building it mid-engagement isn't a plan.
None of this is the assessment. It's overhead sitting on top of it, and it's real cost, paid on every single engagement.
// the fix
One API. Every surface, perfectly in sync.
Dozens of tools and scan types, from network and Active Directory to cloud and web application, sit under one control surface: always installed, always current, always accounted for.
Nothing to assemble
Every tool PoneY covers ships ready to run. No cloning ten repos the night before a job.
Nothing to install
Dependencies, interpreters, and package versions are PoneY's problem, not yours.
Nothing to babysit
Your arsenal's state is always known: no pre-engagement inventory ritual, no post-engagement guessing what ran.
It's not about speed for its own sake. It's so the time you get back goes to the engagement itself, guided when that's convenient, fully manual when the job needs your hands on every command, never back into the arsenal and prerequisites sitting on top of it.
// how you get in
Reachable from anywhere. Reaching everywhere.
Remote testing used to mean a mess of its own: installing tools on a box that could reach the target, standing up a pivot by hand, then hoping the connection and your tool access both held for the rest of the engagement. PoneY manages all of it as one system.
01
Pair a device once
Mobile, desktop, or CLI, a device is paired to an engagement once and PoneY tracks its identity, its state, and who it belongs to from then on.
02
Connect however the job needs
Pivot agent, VPN, or SSH: PoneY stands up and manages the session itself, whichever connection method the engagement calls for.
03
Land on the scan screen, not a setup wizard
Scope, routing, and backend all provision themselves the moment you connect. No manual plumbing between "start an agent" and "scan."
04
Every surface, the same truth
Mobile, dashboard, desktop, and CLI all read and write the same live engagement, in sync with each other, down to a fully offline PoneY Desktop that syncs back up the moment connectivity returns.
// the platform
Switch surfaces. Never switch context.
PoneY isn't a single app bolted onto some scripts. It's a set of purpose-built surfaces that all read and write the same engagement state.
02
Operator & Manager Web Apps
Dashboard / console surfaces
Operator consoles for running and monitoring engagements from a desk, and manager dashboards for oversight across engagements, scope, and findings. The same engagement truth as the mobile app, at desk scale.
03
PoneY Desktop
Native desktop surface, including the CLI
Cloud-connected for full feature access, or fully offline for engagements that need real network isolation: no execution facilitator in the loop, every tool runs directly on the host in front of you, and the engagement data syncs to the cloud or exports to an encrypted archive once you choose to. The CLI ships alongside it for operators who'd rather drive the whole control plane from a terminal.
04
PoneyOS
A full OS, built around the control plane
A preinstalled, curated offensive-security Linux distribution with PoneY's own operator experience built directly into the OS, not bolted on: the same engagement, device, connection, and tool control the dashboard gives you, native to the machine you're already working from.
05
PoneyWare
The backend that runs everything
Cloud-hosted by default: provision in minutes, no compute ceiling, nothing physical to rack or maintain. A physical on-prem companion device is also available as a per-customer opt-in for engagements that call for it, but the cloud backend is the standard path.
06
Buns AI
Embedded AI assistant
Standing analyst for the engagement: correlates findings across tools, normalizes messy scan output, takes freeform operator intel ("switch labeled Catalyst 2960, subnet 10.40.12.0/24") and folds it into what's already known, and recommends the next move.
07
Dynamic Instrumentation Developer
AI-assisted dynamic-tooling builder
When the tool a job needs doesn't exist yet, this is where it gets built: an AI-assisted workspace for standing up dynamic instrumentation and custom tooling on the spot, instead of stalling the engagement.
08
AI Agents for Testing
Autonomous coverage across six domains
The same toolsuite, driven autonomously, across web application, network & service infrastructure, Active Directory, cloud environments, mobile, and wireless/NFC/physical. See the full breakdown below.
// how you work
Guided when you want it. Manual when you need it.
PoneY doesn't force a workflow on you. Two first-class ways of working, same engagement data underneath both.
MODE 01
Guided Engagement Flow
A structured path through the assessment, end to end (recon through reporting) that keeps the engagement organized and makes sure nothing gets missed, even under scope pressure or mid-engagement pivots.
- Standpoint-aware step sequencing
- Nothing silently skipped or forgotten
- Built for full-scope, methodology-driven work
MODE 02
Full Manual Control
Complete operator control over every tool and command. No rails, no guardrails you didn't ask for. Includes CLI-parity explorers for common cloud CLIs (AWS, GCP, and more) so you can run any underlying CLI or PoneY command by hand, exactly as you would from a terminal.
- Every tool, every flag, your call
- CLI-parity explorers for AWS / GCP / Azure and more
- Raw command passthrough when you need it
Same tools. Same engagement record. You pick the level of control the job calls for.
// autonomous coverage
AI agents that test, not just scan.
These agents don't run a separate testing engine. They drive the same toolsuite covered above, autonomously, across six domains. Everything they find lands in the same engagement record as guided and manual runs, which is what Buns actually reasons against.
Web Application
Crawling, auth-flow analysis, and vulnerability discovery aligned to the OWASP Web Security Testing Guide (WSTG).
Network & Service Infrastructure
Discovery, service fingerprinting, and CVE correlation, from passive ARP/CDP recon through full-port scans, across every segment PoneyWare can reach.
Active Directory
Domain enumeration, Kerberoasting, AD CS misconfiguration checks, and BloodHound-style attack-path graphing against on-prem and hybrid identity.
Cloud Environments
IAM misconfiguration, storage exposure, and privilege-escalation path analysis across AWS, GCP, and Azure accounts in scope.
Mobile
Static and dynamic assessment of mobile apps and their backends, aligned to the OWASP Mobile Application Security Testing Guide (MASTG).
Wireless, NFC & Physical
Monitor-mode WiFi attacks, PMKID/handshake cracking, rogue AP work, and NFC/RFID card-technology risk assessment.
// how it's built
Built on the standards. Careful with your data.
Real testing methodology and a clear data-handling model, built into the platform from day one. Evaluate these directly rather than taking our word for it.
Real methodology, not vibes
Every engagement runs against built-in checklists sourced directly from the live OWASP Web Security Testing Guide (WSTG) and Mobile Application Security Testing Guide (MASTG/MASVS) repositories, plus Active Directory, network infrastructure, host security, and CSPM-style cloud checklists for AWS, Azure, and GCP. Pulled from the current standards, not summarized from memory.
Every credential has one home
The Credential Vault is biometrics-gated, per-engagement storage for every credential a tool, Buns, or the operator captures. Every read and write requires on-device biometric auth first. Nothing sits loose in notes or screenshots.
One engagement, one record
The Engagement Knowledge Store merges automated findings and manual operator intel into a single per-engagement source of truth: the same record every surface reads from and Buns reasons against, not five disconnected logs.
Your data, your locality
Cloud-hosted PoneyWare by default, with an on-prem companion device available per customer when data locality requires it. Engagement data stays scoped to its own engagement record. It doesn't bleed into another client's.
Isolated by design, not by convention
Every engagement gets its own dedicated backend and its own security-group pair, enforced by the cloud provider on every packet, not just a routing rule PoneY itself promises to respect. A compromised engagement can't reach another one's hosts even when they share the same underlying infrastructure. Your organization's engagements stay visible only to your organization, full stop.
Every device proves who it is
Pairing a device mints it its own cryptographic identity on the spot, verified on every connection after that, not just the first one. A single-use pairing code gets a device enrolled once; nothing it or anyone else does afterward lets another device impersonate it. Privileged actions are kept off the internet-facing edge entirely, so a compromised front door is never a straight line to the infrastructure behind it.
// questions
Straight answers.
What does early access actually get you?
Hands-on use of PoneY ahead of general availability, direct support standing up your first engagement, and direct input into what ships next. Pricing and packaging are still being finalized alongside the early-access group.
What's the path to general availability?
PoneY is in active early access. We're expanding access in waves as the platform hardens. There's no fixed GA date yet.
How is engagement data stored and isolated?
Every engagement gets its own scoped knowledge store. Automated findings and manual operator intel for one engagement never mix with another. Credentials specifically live in a separate, biometrics-gated vault, not in general notes.
Is the on-prem companion device full feature parity with the cloud backend?
The cloud-hosted backend is the default and where new capability ships first. The on-prem companion device covers the same core toolset for customers who need it, offered per-customer rather than as the standard path.
Do I need to install or maintain my own tools?
No, that's the point. PoneY ships every covered tool ready to run; operators don't install, update, or track dependencies themselves.
What if PoneY doesn't have the tool a job needs?
That's what the Dynamic Instrumentation Developer is for: an AI-assisted workspace to stand up the missing tooling on the spot instead of stalling the engagement.
// early access
Get PoneY before everyone else does.
PoneY is ramping toward general availability. Early access operators get first-line support standing up their engagements and direct input into what ships next.