MTTM < 15m
Turn Vulnerabilities Into Enforced Edge Protection
Zedgenta finds the vulnerabilities reachable from the internet, probes your own edge for the WAF bypasses and edge bypasses that leave them exposed, and closes each one with a rule it re-proves.
Cloudflare · AWS WAF · Akamai · Imperva · F5One vendor-neutral layer for vulnerability-to-WAF coverage and governance.
Event-driven
Nobody presses a button. A finding lands from whatever you already run — pushed the moment it is raised, or polled — and leaves with its mitigation.
Sources in
30+
Native integration — we manage the credentials and sync. Every other tool connects through a single authenticated feed.
Zedgenta
attack variantsWAF bypasses
Your WAF
Enforced at the edge
One pipeline, however a finding arrives: the decision is identical and so is the evidence.
What comes back
Every finding leaves as exactly one of these — in the words your console prints.
Mitigated
A rule we proposed now stops every tested axis, on the payload, without touching legitimate traffic.
Already covered
A layer that predates us stops every tested axis. No new rule — this is how rule sprawl is prevented.
Covered incidentally
Stopped, but by a rule scoped to another class. Real today, fragile tomorrow: nobody owns it.
Partial
Some axes are mitigated; others are provably bypassed.
No safe fix
Every candidate rule that closes the bypass also stops legitimate traffic, so none is proposed.
Not edge-addressable
The class cannot be mitigated by payload inspection. Routed to the owner.
Inconclusive
Not enough evidence. Said out loud rather than rounded to a verdict.
A blue marker claims coverage: measured on your edge, re-proved once the rule is live, withdrawn if the second measurement disagrees.
BYOC
Bring your own cloud
Probe records, payloads and raw edge events land in a bucket you own, under your KMS key, before a verdict returns. Our writer role is denied read — verify that yourself, revoke it without asking us.
BYO LLM
Bring your own AI infrastructure
The same pinned, certified model, reached through infrastructure you already govern: your gateway, Bedrock in your account, or your own provider key — your keys, your quotas, your logging. Sub-processors and residency stated per route.
Any source in
Orca, Wiz, Jira, NVD and CISA KEV. Deduplicated and enriched into a single record.
Any WAF out
Cloudflare, AWS WAF, Akamai, Imperva and F5. One rule model, compiled to each vendor dialect.
Never in the path
Read-only credentials, paired-control probing, pull-request delivery. Rules ship in log mode; promotion to block is yours.
WAF bypasses
The rule is there. Does it hold?
Five axes, probed against the WAF actually in front of it: the canonical payload; encoding it should have normalized; the payload moved to another location; obfuscation by comment and case; structural tricks like chunking. An axis that gets through is a named bypass, with the control that proves it.
Edge bypasses
Which layer acted, if any?
A request can reach the origin without meeting the WAF at all: an origin exposed beside the CDN, a layer that never sees the path, a ruleset in count mode. We read your edge's own events and name the layer that acted — or say nothing did, rather than credit a rule that was never in the way.
Closed, and re-proved
A rule for the bypass, measured again
We compile a vendor-native rule, ship it in log mode with your consent, wait for it to be in force, and probe again. Only a re-measured close is called covered. A rule that would also stop legitimate traffic is never proposed.
Plans · every plan is a custom quote
Startup · hosted · Zedgenta's AI route
Startup
Nothing to install. One source, one edge, read-only. Evidence held for the run; the verdict and its attestation are the record.
custom quote
Business · hosted or BYOC evidence · your provider key
Business
Evidence in your bucket or hosted — your call. BYO LLM on an account you own, upstream pinned. Several edges, several sources, Terraform PRs into your repo.
custom quote
Enterprise · BYOC evidence · BYO LLM in your network
Enterprise
Your gateway or Bedrock in your AWS account, residency stated per route. Every edge vendor, every source, and a named human on every hand-off.
custom quote