Zero Quarry
Zero Quarry is a defensive security service that acts as the security team smaller software companies lack or can't afford, performing security recon and analysis via AI. It uses reliably enforceable authorization mechanisms (e.g., checking a DNS TXT record the way an SSL provider verifies domain ownership) to run live penetration tests against a company's infrastructure, code, and APIs. It triages incoming 'security researcher' emails to cut down noise from nonsense vulnerability reports, and issues provable, signed attestation that a pentester has checked and validated systems or verified remediation, helping companies, pentesters, and auditors/customers agree on what's important and what's been solved.
What it addresses
Smaller companies lack security teams and can't afford them; LLM lab policies block security research and vulnerability finding unless specially registered, treating anything the model deems security research as a threat; and companies are flooded with noise from nonsense 'security researcher' vulnerability reports.
Shared over time
Each entry reflects what was shared on that date. Details may have changed since then.
Zero Quarry
Zero Quarry is a defensive security service that acts as the security team smaller software companies lack or can't afford, performing security recon and analysis via AI. It uses reliably enforceable authorization mechanisms (e.g., checking a DNS TXT record the way an SSL provider verifies domain ownership) to run live penetration tests against a company's infrastructure, code, and APIs. It triages incoming 'security researcher' emails to cut down noise from nonsense vulnerability reports, and issues provable, signed attestation that a pentester has checked and validated systems or verified remediation, helping companies, pentesters, and auditors/customers agree on what's important and what's been solved.
Problem: Smaller companies lack security teams and can't afford them; LLM lab policies block security research and vulnerability finding unless specially registered, treating anything the model deems security research as a threat; and companies are flooded with noise from nonsense 'security researcher' vulnerability reports.
Audience: Smaller software companies that can't afford an in-house security team, along with pentesters and auditors/customers who need verified security attestation.
Posted by @eskibars · Original comment ↗
“https://zeroquarry.com/ It's an approach to defensive security for software products (especially smaller companies) by acting as the security team you don't have/can't afford. It does security recon/analysis, etc via AI.”