Skip to main content
Gimorra is the autonomous offensive-security platform within Vigolium. It hunts while you sleep. Give it an authorized target, a goal and a scope. It takes the engagement from there — recon → scan → propose a PoC → prove it → report — and wakes you only when blast radius demands a human. Vigolium is the engine. Gimorra is the operator.
Walkthrough of a gimorra scan: brief, recon, proposed candidates, deterministic confirmation

One run, start to finish: a brief becomes a plan, recon maps the target, the agent proposes candidates, and the validator throws out everything it cannot prove

Want to see it work? Request a Demo, or head to gimorra.vigolium.com.

​
Safety by construction, not by babysitting

Most offensive agents ask a human to approve every action. That is not caution — it is an admission that the agent could do real damage if nobody is watching. Gimorra closes that gap in code. Three controls make a run incapable of hurting the target, so supervision becomes a dial you set once instead of a seat you sit in.

The validator decides

The agent proposes. Code disposes. Every finding is re-proven by deterministic, non-AI code using the least invasive action that settles it. Nothing self-certifies.

Cleanup and a kill switch

Whatever a run touches, it puts back. One command ends the engagement: queued work goes unclaimable, and no further proof is accepted.

Scope guard on every call

Deny wins. Ambiguity blocks. Checked on every single tool call, before anything else gets a vote.
None of the three touches the model, the agent, or the network stack. Prompt-inject the model and they still hold. That is the whole design.
Gimorra operates only against targets you are authorized to test. No authorization artifact, no active operation — enforced in code, not in policy.

​
Point it at anything

One dial sets how hard it pushes, from fully passive to aggressive. Nothing else needs tuning to get a first result.

​
What lands on your desk

Bugs, not maybes

Every finding in the report was reproduced by deterministic code. No triage queue of plausible-looking noise.

Receipts for all of it

A hash-chained evidence trail ties each finding to the exact exchange that proved it.

A report you can forward

Verified-only Markdown or HTML, plus a live dashboard while the run is still going.

Memory between runs

Surface, tradecraft and accounts carry forward, so the second engagement starts where the first stopped.

​
Where it sits

Gimorra runs its tools on the machine you start it on, so that machine is the blast radius. Start it in a container — there is an all-in-one image for exactly this.
Curious what it finds on your own target? Request a Demo, or email [email protected].