Decima Systems // Autonomous Adversary Emulation
Est. 2026 / Scoped, authorised, logged
The offer
An autonomous, unconstrained attacker runs against your infrastructure on a standing basis. It does not refuse, it does not scope itself down, and it does not stop when the engagement window closes.
The model runs on hardware we control, so nothing about your environment is ever handed to Anthropic, OpenAI or Google. Every target is proven to belong to you before a single packet is sent.
Engagement parameters
| Posture | Adversarial |
| Model residency | Self-hosted |
| Cadence | Continuous |
| Authorisation | Written, per target |
| Territory | United States |
01 / The asymmetry
Figures below are from No Human in the Loop, second edition, our founder's research on autonomous agent security.
88%
of enterprises had an AI agent security incident in the twelve months to February 2026.
6%
of those enterprises had deployed any advanced AI security defence.
195:1
documented return on investment for adversaries attacking defended organisations.
2/100
security score for the most widely deployed open-source AI agent framework.
An estimated 1,500,000 AI agents are operating in production today with no security oversight of any kind.
02 / Method
Nothing leaves your perimeter. Including to us.
The models run on hardware we control, or on hardware you own. No prompt, no credential, no configuration file and no artifact of your environment is transmitted to a third-party model provider. For a regulated institution this is not a feature, it is the precondition.
Commercial models refuse. Real attackers do not.
Ask a frontier model to compromise a host and it declines. That refusal is the correct product decision and a fatal testing limitation. Decima runs current open-weight models with the refusal layer removed, so the simulated adversary pushes exactly as hard as the one that never asked permission.
An operator, not a chatbot with shell access.
The harness was built for offensive work specifically. Reconnaissance, exploitation, lateral movement, privilege escalation, persistence and exfiltration simulation run in one continuous agentic loop, holding state across days rather than across a single prompt.
A penetration test is a photograph. You need the film.
Your attack surface changes every time someone merges a branch or clicks through a cloud console. Decima runs against your estate on a standing basis and tells you the hour something opens, not at the end of next quarter when the report is finally typeset.
03 / Services
Start anywhere. Most clients begin with the surface, then move to the standing adversary once they have seen what the first pass turned up.
| Code | Service | Detail | Cadence | Scope |
|---|---|---|---|---|
| AE-01 | Autonomous adversary emulation | A standing attacker against your production estate. Chains findings the way a human operator would, then documents the path it took and the point where you could have stopped it. | Continuous | External + internal |
| AI-02 | AI agent & LLM security reviewOur specialism | Prompt injection, tool-permission escalation, memory poisoning and agent-to-agent trust abuse. The attack surface almost nobody is testing, assessed against the OWASP LLM Top 10 and our own field research. | Per release | Specialism |
| AS-03 | External attack surface assessment | Everything of yours that faces the internet, including the things nobody told you about. Forgotten subdomains, stale DNS, exposed consoles, leaked credentials, shadow cloud accounts. | Continuous | Discovery |
| CL-04 | Cloud & identity attack paths | The graph from a low-privilege foothold to your crown jewels across AWS, Azure, GCP and your identity provider. Role chains, trust policies, over-broad service principals. | Continuous | AWS / Azure / GCP |
| RT-05 | Red team operations | Full-scope, objective-driven engagements with human operators directing the harness. Social engineering, physical and assumed-breach scenarios against a live blue team. | Scheduled | Human-led |
| RM-06 | Remediation & hardening | The half most firms leave out. We stay through the fix, retest what you changed, and hand your engineers the specific configuration rather than a severity rating. | Post-engagement | Retest included |
04 / The output
Every run returns the chain the adversary walked, hop by hop, with the evidence attached and the one change that would have broken it.
Attack path DS-4471
Illustrative path. Findings from a live engagement are exportable with the full evidence chain.
05 / Rules of engagement
We build an attacker that behaves as if it has no rules. The company operating it has a great many, and they are not negotiable.
Notice
Decima Systems tests infrastructure that our clients own or are contractually authorised to test, and nothing else. We decline unattributed work, and we report attempts to procure it.
Every domain is verified by a DNS record only its operator can publish. Every IP range is checked against registry data and a signed attestation. An unverified target cannot be scanned, and the control is enforced in the database, not in the interface.
A named officer of your company signs the rules of engagement for each scope, with their title and the date recorded. We keep that record for the life of the relationship and hand you a copy.
No denial of service, no data destruction, no ransomware simulation that actually encrypts. Where proving impact would require causing it, we stop at proof of access and document the rest.
Every action the harness takes is logged with a timestamp, the operator and the target. If a regulator, an insurer or your own board asks what happened on a given afternoon, you get an answer.
A named operator and a deconfliction line. If your on-call team sees something and needs to know within ninety seconds whether it is us, they get a person on the phone.
Our own infrastructure is tested by the same harness on the same cadence, and we will show you those results before you sign anything.
06 / Terms
No procurement theatre, no six-week statement of work. Verify a target and the harness starts the same afternoon.
$299
per month
Continuous external attack surface mapping. What the adversary sees before it decides you are worth the effort.
$1,499
per month
The full harness. An autonomous, unconstrained attacker runs against your estate on a standing basis.
Bespoke
annual engagement
The harness deployed inside your perimeter, on hardware you own. Nothing crosses your boundary, including us.
All tiers require verified target ownership and a signed rules-of-engagement record before the first scan. Annual billing on request. Excludes applicable US sales tax.
07 / Leadership
Decima was founded by the chief technology officer of Byte Federal, one of the largest Bitcoin ATM networks in the United States. The security opinions here were formed running real infrastructure that real adversaries attack for money, not in a lab.
He wrote No Human in the Loop: Cybersecurity in the Autonomous AI Age, now in its second edition at 572 pages, documenting how autonomous agents changed the economics of attacking a company. Decima exists because the research kept arriving at the same conclusion: the only honest way to measure your exposure to a machine-speed attacker is to point one at yourself first.
He also deploys autonomous agents that trade real capital, which is a fast education in what an unsupervised model does when nobody is watching it.
“Friday, 14:00 UTC. Five thousand adversarial agents begin their assault. The defenders have twelve humans.”
Opening line / No Human in the Loop
Dossier
| Operating role | CTO & co-founder, Byte Federal |
| Scale under management | 1,300+ machines, 42 states |
| Certifications | CISSP · CCSP · CSSLP |
| Education | M.A. Computational Linguistics & AI |
| Compliance | Led ISO 27001 to award |
| Published | No Human in the Loop, 2nd ed. |
08 / Questions
Autonomous adversary emulation is continuous, machine-driven attack simulation against infrastructure you own. Instead of a consultant spending three weeks and delivering a report, an AI agent runs reconnaissance, exploitation and lateral movement against your estate on a standing basis and reports the moment a path opens. It differs from vulnerability scanning because it chains findings into complete attack paths the way a human operator would.
A penetration test is a point-in-time snapshot, typically annual, scoped to what fits the budget. Your attack surface changes every time an engineer merges a branch or opens a cloud console. Decima runs continuously, so the finding arrives the hour something opens rather than at the end of the quarter. Traditional tests remain useful for compliance attestation, and we deliver those too.
No. Decima runs open-weight models on hardware we control, or on hardware you own under the Sovereign tier. No prompt, credential, configuration file or artifact of your environment is transmitted to a third-party model provider. For regulated institutions this is usually the deciding factor.
Commercial frontier models refuse to perform offensive operations. That is the correct product decision for a general assistant and a fatal limitation for security testing, because a real attacker faces no such refusal. Decima runs current open-weight models with the refusal layer removed so the simulated adversary applies the same pressure the genuine one will. This capability is used only against targets whose ownership has been verified and for which written authorisation is on file.
Ownership is proven before anything runs. Domains require a DNS TXT record that only the zone operator can publish. IP ranges and CIDR blocks require registry checks plus a signed attestation from a named officer, and are reviewed by a human. Private, reserved and government address space is rejected at intake. An unverified target cannot be scanned, and that rule is enforced in the database rather than in the interface.
Yes, and it is our specialism. We assess prompt injection, tool-permission escalation, memory poisoning and agent-to-agent trust abuse against the OWASP LLM Top 10 and our own field research. Our founder wrote the book on the subject. Research cited on this site found that 88 percent of enterprises experienced an AI agent security incident in the twelve months to February 2026, while only 6 percent had deployed advanced defences.
Yes. Continuous adversary emulation covers the penetration testing requirement in SOC 2 Type II, PCI DSS 4.0 requirement 11.4 and the HIPAA Security Rule evaluation standard, and continuous evidence is generally stronger than an annual snapshot in front of an auditor. We provide attestation letters and the full evidence chain as standard.
Recon starts at 299 dollars per month for continuous external attack surface coverage on up to three verified targets. Adversary is 1,499 dollars per month for the full autonomous harness on up to fifteen targets. Sovereign is a bespoke annual engagement deployed inside your perimeter. Sign up, verify a target with a DNS record, sign the rules of engagement, and the harness starts the same afternoon.
Next
Verify one domain. See the first pass. Decide afterwards whether you want the standing adversary. No sales call required to start.