Outside-in recon
Domains, subdomains, IPs and CIDR ranges mapped the way an attacker sees them.
01—perimeter
Define what the outside
can see.
ARROW is a black-box security assessment platform. Point it at the assets you own and an agent walks each one from the internet inward — mapping every reachable surface and proving what actually breaks.
authorized external assessment only · passive + active · outside-in
Agent-driven testing
A supervisor plans the phases; specialists test each surface, bounded by an action policy.
Verifier-confirmed findings
Nothing is marked confirmed until an independent replay proves it twice.
Attack-path topology
Nodes, reachability and coverage in one concentric view, not a flat host list.
The run, phase by phase9 phases
- 01scope
- 02scout
- 03expand
- 04examine
- 05nuclei
- 06probe
- 07supervise
- 08verify
- 09report