We model your environment. Then we hack it.

CYBRET AI is the autonomous security lab. Reasoning engine for security: exposure intelligence, validation, runtime detection — one platform, one graph.

Products · Research · Pricing · Contact · Trust

JavaScript is required for the full CYBRET AI experience.

News

Releases, research,
and the long version.

We post when something is true. No quarterly slop, no vanity launches.

FEATUREDRelease · Platform

Reachability scoring v2 ships GA
one graph across code, cloud, and identity.

The next-generation scoring model reconstructs exploitable paths across code, cloud, and identity in a single graph. Rolling out to all design partners this cycle, with streaming subscriptions landing in the API layer next month.

FEB 14, 2026 · CHANGELOG 2026.02

13 ENTRIES

API v1.2: streaming reachability subscriptions

Long-poll replaced with server-sent events. Path verdicts now stream as they resolve.

Changelog 2026.04

When counterfactuals disagree: interpreting multi-engine verdicts

A note from CYBRET Labs on what to do when your reasoning engines don’t converge.

Sub-100ms path reconstruction on billion-edge graphs

Why we swapped the scoring hot path to a compressed adjacency layout, and what it cost us.

CYBRET Eng Blog

Reachable-path class in a widely deployed CI/CD runner (CVE-2026-XXXX)

Identity confusion between build and deploy contexts allowed a scoped token to cross boundaries.

CYBRET Labs · CVE-2026-XXXX

cybret-graph: a minimal reachability graph library in Go

The adjacency core we use internally, released under Apache 2.0. No lock-in, no telemetry.

github.com/CYBRET-AI/cybret-graph

Scope contracts as a substrate for agentic defense

A whitepaper on bounding what an autonomous responder may touch, and why policy precedes action.

Validation 1.4: evidence bundles and re-run timelines

Every validated finding now ships with a reproducible capture plus the command to rerun it.

Changelog 2026.01

Path-traversal variant in a popular artifact proxy (CVE-2026-XXXX)

Path normalization diverged between the admin API and the download handler. We reported it.

CYBRET Labs · CVE-2026-XXXX

CYBRET-Bench: 1,200 labelled attack graphs for adversary-model research

An open evaluation set for reachability and privilege-escalation models. CC-BY-SA.

Runtime Detection adds call-trace resolution for Go and Rust workloads

Inline symbolication and frame stitching across async boundaries, without sidecars.

Changelog 2025.11

Why we rebuilt our scoring model from scratch

A retrospective on throwing out six months of heuristics and what the rewrite bought us.

CYBRET Eng Blog

Exposure Intelligence GA: graph-first inventory

The first product release. Reachability graphs over code, cloud, and identity, in one place.

Changelog 2025.07

Field notes: what design partners actually ask for

Six months of partner conversations, synthesized. No logos, no pull quotes, just patterns.

Staying in the loop

No newsletter cadence.
No marketing drip.

Follow CYBRET Labs on GitHub

github.com/CYBRET-AI · releases, benchmarks, and disclosures

Subscribe to the changelog RSS

Release notes and disclosures only · no editorial

Start today

Connect a repo.
See your first proven path.

Read access. 30 minutes. No credit card.

Book a Demo Talk to sales