[ A Hesed & Emet platform ]
An agentic AI red team that pentests your whole stack and your people, then proves every finding.
The adversary now moves at machine speed, chaining a cloud misconfiguration to domain admin, and reaching your people with cloned voices and live deepfakes. Cherubim meets them on every front, with proof, under your control.
The console
Launch, watch agents work, prove findings, coach your people, and export audit evidence, all from one place.
◧
A live ops console with a tmux-style 2x2 of operator terminals: recon, identity, web plus cloud, and validator with planner, each showing real tool calls (nmap, BloodHound, impacket, ffuf, aws, kubectl) with a blinking caret on the active pane.
✦
A conversational operator that actually drives the platform. Tell it to run a campaign, open findings, coach the people who slipped, or export the board pack, and it does.
◆
Each finding carries the typed validator code and the last three sandbox runs with a SHA-256 signature. The deterministic claim is inspectable, line by line.
▤
Every operator action and every agent tool call lands in an append only ledger, signed per line. Everything in the UI is also a CLI, so it slots into your pipeline.
◷
A 12 lesson library, delivered on Microsoft Teams, Slack, Outlook or SMS, triggered the moment a learner clicks a lure or approves a prompt, with a frequency cap that keeps it humane.
⊛
See the agent fleet, who is doing what, which typed tools they are calling, and the long-horizon plan tree replanning in real time. Nothing is a black box.
The platform
Most tools cover one surface. Real attackers do not. Cherubim runs four engines under one intelligence layer, so a weak signal in one becomes the opening move in the next.
A swarm of reasoning agents that maps, exploits, and chains weaknesses across web, API, cloud, and identity, at machine speed.
Explore the engineNetwork, web, API, cloud, Kubernetes, identity, Active Directory, wireless, OT, and supply chain. Every layer, one continuous kill chain.
Explore the coverageOrchestrated campaigns across email, SMS, WhatsApp, voice, and live deepfake video on Zoom and Teams, with Slack and Teams follow up.
Explore social engineeringEvery result becomes a graded, reproducible finding plus a kind, blame free lesson delivered on Microsoft Teams, Slack, Outlook or SMS, the moment it matters.
Explore reportingGuardian 01
Cherubim does not run one scanner and hand you a list. It deploys a coordinated set of autonomous agents, each focused on a specific objective, that reason about your environment, attempt real exploit paths, and chain low signals into a full attack.
The difference that matters is what happens after a finding. Every candidate vulnerability is passed to a deterministic validator that reproduces the exploit in a sandbox and captures the proof. A finding only reaches you once it has been demonstrated, never because a model felt confident.
The agentic core
Anyone can put a model in a while loop. What makes an engagement real is the machinery underneath: many specialists working together, a disciplined way to use real tooling, and the patience to pursue a goal over hundreds of steps. This is the part that takes Cherubim from a clever prototype to an operator that finishes the job.
Cherubim runs a fleet of specialised agents, each an expert in one surface, reconnaissance, web, cloud, identity, network, and exploitation. They share one world model and coordinate over a common blackboard, so an artifact one agent recovers becomes the key another agent uses several steps later. A supervisor arbitrates priority, removes duplicate work, and holds the whole fleet inside scope.
// blackboard architecture · supervisor or worker · up to 120 concurrent agents
Agents do not improvise. Every offensive capability, from a port scan to a Kerberos attack to a cloud API call, is a registered tool with a typed schema, scoped permissions, and an audit record, the same pattern as the Model Context Protocol. Cherubim wraps battle tested open source and commercial tooling rather than reinventing it, and mediates every call so it is logged, sandboxed, and reversible.
// typed schemas · per-call audit · sandboxed and reversible execution
Real attacks unfold over many steps, so Cherubim plans like an operator. It sets an objective, reach the crown jewel, decomposes it into subgoals and tasks, and continuously replans as the environment responds. It carries state across hundreds of actions, backtracks out of dead ends, and keeps a persistent memory of what worked, so the next engagement starts smarter than the last.
// goal graph · reflection and memory · resumable across hundreds of steps
See it live. The console shows the agent mesh, the tools each agent is calling, and the plan tree updating in real time during an engagement.
Proof and trust
Buying an autonomous red team is buying judgement. Here is who built it, what it has measured, where it runs, and what it deliberately will not do.
A
Cherubim is built by Hesed & Emet Advisory, a Singapore practice working where AI, cybersecurity and human behaviour collide. The founding team and senior advisors carry careers from Singapore's Cyber Security Agency, regulated financial services, and offensive security research.
B
Numbers we will show a buyer's red team, not slogans. Measured against authorised engagements in regulated environments, and against the autonomous pentest scenarios the industry already benchmarks on.
C
Runs where the regulator says it must run. SaaS in your region or fully in your VPC, with the platform itself audited the way you would audit a critical vendor.
D
The boundary is in the product, not the contract. The platform refuses to do these things, by design.
References available to your red team and your auditor under NDA, including the validator code and the evidence-pack signature scheme.
Guardian 02
A real adversary does not respect the boundaries of your tooling. They start at an exposed edge, pivot through the network, and do not stop until they own identity. Cherubim runs the same kill chain across every layer of the stack, as one continuous engagement, not a folder of disconnected reports.
The autonomous engine performs reconnaissance, exploitation, lateral movement, privilege escalation, and exfiltration simulation, then proves the full attack path end to end the way an operator would walk it.
Guardian 04
The name behind this platform means kindness and truth. Cherubim is built to honour both. Findings are delivered with the truth a board needs to act, and the people who were tested are met with coaching, never blame.
Every technical and human result lands in one evidence graded report. Leadership sees risk in business terms. Engineers get a reproducible proof of concept and a fix. The tested employee gets a short, supportive lesson tied to the exact moment that mattered, so the next attempt fails.
Why Cherubim
The market is full of point tools. An autonomous web pentester here. A separate network scanner there. A cloud posture tool. A phishing button. A deepfake demo. Cherubim is the flagship that unifies the entire stack, and refuses to ship a finding it cannot prove.
For the technical reader
Nothing here is speculative. Every capability maps to techniques that are already proven in offensive security and synthetic media. Cherubim is the engineering discipline around them.
A planner that decomposes an engagement into objectives and dispatches specialised agents. Tool use is mediated through a typed interface, so every action an agent takes is logged, scoped, and reversible.
Findings are confirmed by non model code that reproduces the exploit in an isolated sandbox. This is the documented reason autonomous pentesters reach human grade precision rather than drowning teams in false positives.
Voice cloning and real time face synthesis feed a virtual camera and audio device, which is how a deepfake persona joins a standard Zoom, Teams, or Meet session. Every asset is watermarked and access controlled.
Email, SMS, WhatsApp, voice telephony, and workspace messaging integrate through their official interfaces, so a campaign runs on the same rails your organisation already uses.
A shared state object carries the pretext across channels and stages, so the WhatsApp message, the call, and the video meeting all reference one consistent story and escalate only on engagement.
Immutable, access controlled storage for transcripts, recordings, payloads, and proofs, with full chain of custody for legal and audit review.
Governance
A platform that can clone a voice and join a live call carries real responsibility. Cherubim treats authorization, consent, and restraint as core features, not paperwork.
Compliance
Most teams run a test, then spend weeks translating findings into the language an auditor or a regulator accepts. Cherubim closes that gap. Every validated finding is mapped, in real time, to the control objectives of the frameworks you are held to, and assembled into an evidence pack you can hand over as is.
Findings mapped across Govern, Identify, Protect, Detect, Respond, and Recover, with SP 800-53 and 800-115 control references.
Evidence aligned to Critical Information Infrastructure obligations and CSA audit and risk assessment expectations.
Coverage mapped to the risk based domains, so certification preparation becomes a report export, not a project.
Direct evidence for the baseline measures, ideal for organisations on the first rung of the certification ladder.
Annex A control mapping with reproducible proof attached to each applicable statement of applicability item.
Penetration testing and adversarial attack simulation evidence formatted for financial sector supervisory review.
Demonstrated protection of personal data with attack path proof that controls hold under real adversary pressure.
Every step of every proven attack path tagged to ATT&CK techniques for defensive coverage analysis.
Implementation Group mapping that shows which controls actually withstood the engagement and which did not.
One click audit
The audit pack is not a second exercise. It is generated from the same campaign that proved the findings, so the evidence an auditor reads is the exact proof Cherubim captured, with timestamps and chain of custody intact.
Executive reporting
The same engagement produces every view automatically. The board sees risk and decisions. The auditor sees control evidence. Engineering sees a reproducible fix. Nobody re writes the story for a different audience, because there is only one story.
Outcomes
A validated picture of how an adversary reaches impact across network, cloud, identity, and people, with the evidence to back every claim.
Reproducible proofs of concept remove triage debate, so fixes ship instead of stalling in a backlog.
Trend lines that show leadership the organisation is genuinely harder to attack quarter over quarter.
One narrative that turns technical and human risk into decisions an executive team can actually make.
Questions
Yes, by design. Cherubim never pursues real loss. It demonstrates the path, captures the proof, and stops. Every engagement is gated by signed authorization, bounded by rosters and exclusion lists, and stands down on distress.
A scanner reports possibilities. Cherubim reasons, exploits, and then proves the finding with a deterministic validator. If it cannot reproduce the exploit, it does not become a finding.
Under explicit authorization and consent, yes. Real time synthesis feeds a virtual camera and audio device into a scheduled Zoom, Teams, or Meet call. This mirrors a real and growing attacker technique, which is exactly why it must be tested.
They are coached, not blamed. The truth goes to the board. Kindness goes to the team. That balance is the point of the platform.
Yes. Continuous mode re tests on every release and on a defined cadence for the human surface, so resilience is measured, not assumed.
Request a briefing
Bring Cherubim into a scoped engagement and see, with proof, exactly how a serious attacker would move through your code, your AI, and your people.
Start the conversationA Hesed & Emet platform. Advising where AI, cybersecurity, and human behaviour collide.
Guardian 03
Orchestrated Omnichannel Social Engineering
A real social engineering attack is not one email. It is a calendar invite, then a WhatsApp message that sounds like your CFO, then a Teams call where the face on screen is convincing enough to move money. Cherubim runs that full chain, safely, with consent, and with a central intelligence layer that adapts each stage to how the target responded to the last one.
Phishing email
Context aware lures generated from open source signals about your organisation, graded by who clicked, who reported, and who escalated.
Smishing and WhatsApp
SMS and WhatsApp pretexting that mirrors how modern attackers move a target off corporate channels and onto a personal device.
Voice and vishing
Consented voice cloning of an authorised internal persona to test whether a phone call alone can unlock a process it should not.
Live deepfake video
Real time face and voice synthesis that can join a scheduled Zoom, Microsoft Teams, or Google Meet call, to test executive impersonation under live conditions.
Slack and Teams
Internal messaging follow up that exploits the trust people place in tools inside the perimeter, the channel attackers love most.
Helpdesk and process
Targeted engagements against password reset, MFA recovery, and vendor onboarding, the human processes that bypass every control you bought.
Why orchestration is the product
Each channel on its own is a commodity. The value is the narrative engine that keeps one story consistent across all of them, escalating only when the target leans in and standing down when they resist or report. That is exactly how a serious adversary operates, and it is the only honest way to measure whether your people would actually catch them.