What is Pentriarch? Penetration testing with replayable proof

Pentriarch is a penetration testing platform built around one idea, that security evidence should be fast, reproducible and verifiable. It tests the systems that matter most to a modern business, from web applications and APIs to the AI agents and MCP servers that companies now connect to their most sensitive data, and it delivers every result in a form that your engineers and your customers can check for themselves.

This article opens a five-week series in which we explain how Pentriarch works and why we believe penetration testing has to change. If you only read one piece, this is the one that tells you what we do.

For years our founder, Collin Ambani Anjeo, led security assessments, and the same frustration followed him from one engagement to the next. The report arrived weeks after the testing had finished. The findings were hard to reproduce, so engineers spent days trying to see what the tester had seen. And when a fix finally went live, nobody could say for certain whether it had actually closed the hole.

None of this is the fault of the people doing the work. It is the shape of the work itself, with long gaps between testing and reporting, evidence captured as screenshots rather than something a developer can run, and retesting treated as an afterthought. Pentriarch is our answer to that frustration.

Pentriarch tests web applications, APIs and external networks, the familiar ground of any security assessment. It also tests AI agents and MCP servers, mapping what it finds to the OWASP Top 10 for LLM Applications, which lists risks such as prompt injection and excessive agency.

That second area matters more every month. The Model Context Protocol specification itself warns that tools represent arbitrary code execution and must be treated with appropriate caution. When an AI agent can read your files, update your CRM or raise a refund, it deserves the same scrutiny as any other route into your systems.

Every finding Pentriarch reports carries a replayable request, the exact request that triggered it, together with a deterministic validator, a fixed and repeatable check that decides whether the response really shows the weakness. Your engineers can replay the proof themselves rather than taking our word for it.

This is also how we use AI responsibly. AI is good at spotting things that look dangerous, so we let it flag suspicions. But an AI can never certify a vulnerability on its own. If the validator does not hold, the finding does not make the report, however convincing the AI sounded.

Every assessment produces a signed, tamper-evident report pack. Each document is hashed, the hashes are gathered into a manifest, and the result is signed with Ed25519, the signature scheme described in RFC 8032. Anyone holding the pack can check it through a public verification route without asking us for anything.

If a single line has changed since we signed it, the check fails. A signature proves that the pack is genuine and unaltered. It does not, on its own, prove that a system is secure, and we are careful to say so.

When your team has fixed a finding, the retest replays the original proof and runs the same validator against the fresh response. The answer is stated plainly, finding by finding, as verified fixed or still present. If the target could not be judged, for example because of a timeout, the result is reported as inconclusive and never counted as fixed.

Pentriarch will not send a single test to a system until its owner has proved control of it, either with a DNS TXT record or with a file placed at a well-known location on the website. Every engagement is then tied to a signed engagement grant that records exactly which hosts and paths may be tested and for how long. Consent is proven before any traffic, not simply ticked.

The quickest way to understand the workflow is our interactive product tour at pentriarch.com/demo, which takes a few minutes. When you are ready to see results on your own system, the 14-day pilot at pentriarch.com/pilot needs no card. Findings can flow straight into the tools your team already uses, including Jira, Linear, ServiceNow, Slack and Microsoft Teams.

Over the coming weeks we will go deeper into each of these ideas, from AI agent security to signed reports and honest retesting. We would love your view along the way.