Question 1

Is it safe to run this against production?

Accepted Answer

Yes, and that is the entire design constraint. Agents use non-destructive techniques, respect enforced rate limits, and halt on anything fragile. They prove access rather than exercising it — demonstrating that a path to your database exists without reading a single customer record. Most teams start on staging for a week, review the audit log, then move to production.

Question 2

How is this different from an automated scanner?

Accepted Answer

A scanner matches your systems against a list of known signatures and reports what pattern-matches. It cannot tell you whether any of it is reachable. K0G agents reason about intent, attempt real exploitation, and chain findings together. The output is a much shorter list where every entry is proven.

Question 3

Does this replace our pentesters?

Accepted Answer

No, and be sceptical of anyone claiming it does. Novel research, deep protocol work and high-judgment assessment remain human strengths. K0G removes the repetitive majority so your specialists spend their engagement on problems that actually need them.

Question 4

What stops an agent going out of scope?

Accepted Answer

Scope is enforced at the network layer, not requested in a prompt. Authorised assets are declared before a run begins, and an agent attempting to resolve anything outside that boundary is terminated and flagged. This is architectural rather than behavioural.

Question 5

Will this satisfy our compliance requirements?

Accepted Answer

K0G produces evidence packages formatted for SOC 2, PCI DSS and ISO 27001, including the full audit trail and remediation verification. Where a framework requires a human-signed engagement letter, K0G runs alongside that engagement rather than instead of it.

Question 6

How do you handle our source code?

Accepted Answer

K0G operates black-box against running systems by default and needs no source access at all. Granting repository access unlocks pull-request remediation. If you enable it, code is processed in an isolated tenant, never retained after a run, and never used to train shared models.