Anyone responsible for the security of an organization’s domain, using a work email on that domain or one of its subdomains. Personal and disposable email addresses are not accepted. A Strobes analyst reviews every request, and we may decline requests where ownership or authorization is unclear.

Internet-facing assets on the verified domain that you confirm as in scope during analyst review: domains, subdomains and IP ranges. Research covers asset discovery, exposed services, TLS and email security, leaked secrets in public sources, known CVEs and application-layer issues. Third-party hosted assets are excluded from testing.

Will testing disrupt production?

Testing is designed to be non-disruptive. We do not run denial-of-service, load or destructive tests, and analysts agree exclusions and testing constraints with you during scope review. You can ask us to pause research at any time.

How is my data handled?

We collect the domain, company name and verified email address you submit, along with the findings we produce. Findings are stored in Strobes systems with restricted access, shared only with the verified contact, and never published. Issues affecting a third-party vendor are handled through coordinated disclosure with that vendor.

How will I receive the report?

By email from noreply@strobes.co to your verified address, with a link to view and download the report. Add noreply@strobes.co to your allowlist so reports are not filtered. The address does not accept replies.

How do I ask questions about my findings?

Every report email includes a link to a follow-up form. Use it to ask about a specific finding, request remediation help or request a retest. Submissions go directly to the analyst team and are linked to your original request.

Is there a commercial commitment?

No. Enrolling does not commit you to buy anything. Strobes is a commercial company and this program sits alongside our paid products, but purchasing them is not a condition of the program.

Strobes ResearchSAFLResearch programOctober 2026

Attacker’s First Look

A continuous, authorized research program for internet-facing infrastructure.

Strobes analysts and AI agents research the external attack surface of enrolled organizations on an ongoing basis, confirm what is exploitable, and report findings privately to the verified owner with the evidence and guidance needed to fix them.

Apply to the program Program terms

Purpose

External attack surfaces change faster than most organizations can test them. This program applies AI-driven research to that problem, continuously, under explicit authorization and with human review at every step.

Product teams create subdomains, marketing platforms are connected to corporate domains, certificates are issued, services are exposed and credentials find their way into public code. A periodic assessment records the surface at one moment; the surface continues to move after the report is delivered.

AI has changed the economics of finding these exposures. The same capability that lets an adversary examine thousands of hosts in the time a person examines one is available to defenders. Attacker’s First Look puts that capability to work for organizations that ask for it, and directs it only at infrastructure they have verified they own.

The program in one sentence

You verify that you own a domain; we research it continuously with AI agents and analysts; confirmed findings are reported privately to you with the evidence and guidance to fix them.

Scope of research

Each research cycle begins with discovery from public sources and continues with authorized testing of the assets you confirm as in scope.

Table 1 · Research areas

Area	What is examined	Method
Subdomains and internet-facing assets	Hosts found through certificate transparency, passive DNS and other public records, including assets missing from your inventory.	Discovery
Exposed services	Open ports, administrative interfaces and services reachable from the internet that do not need to be.	Discovery and testing
TLS and email security	Certificate and protocol configuration, HSTS, and SPF, DKIM and DMARC on sending domains.	Discovery
Leaked secrets and credentials	Keys, tokens and credentials tied to your domain in public code repositories and paste sites.	Discovery
Known vulnerabilities	Software and versions on exposed assets matched to known CVEs, then tested to confirm exploitability.	Testing
Application-layer issues	Authentication, access control and injection issues in in-scope web applications and APIs.	Testing

Discovery uses public sources only. Testing takes place only on scope confirmed in writing by a Strobes analyst.

Operating model

Enrollment is a short, verified application. Everything after it is reviewed, scoped and continuous.

Figure 1 · Program operating model

01
Application
The requester submits the domain and organization name.
Requester
02
Ownership verification
A one-time code is sent to a work email on the domain. Personal and disposable providers are rejected.
Requester
03
Review and scope
An analyst reviews the application and agrees scope: domains, subdomains, IP ranges and exclusions.
Strobes analyst
04
Research
AI agents and analysts research the agreed scope on a continuing basis and validate what they find.
Strobes
05
Reporting
Findings are emailed to the verified contact from noreply@strobes.co with severity, evidence and remediation guidance.
Strobes
06
Follow-up
Questions, remediation help and retest requests go through the follow-up form linked in every report.
Requester and Strobes

Stages 4 to 6 repeat for as long as the enrollment is active.

Research does not end with the first report. While an enrollment is active, testing continues on the agreed scope, new findings are reported the same way, and fixes can be retested on request.

Authorization and safeguards

We only actively test domains whose ownership the requester has verified, and a person reviews every enrollment before any testing begins.

Ownership is verified with a one-time code sent to a work email address on the submitted domain or one of its subdomains. Personal and disposable email providers are rejected, because an address at a public mail service says nothing about who controls a domain.

Verification establishes control of an address on the domain. It does not on its own authorize testing. A Strobes analyst reviews every application and agrees scope with the requester before any testing begins: the domains, subdomains and IP ranges in scope, and exclusions such as third-party hosted assets. We may ask for further confirmation, and we decline applications where ownership or authorization is unclear.

Submitting a domain does not start testing

Nothing is run against your assets until an analyst has reviewed your application and confirmed scope with you.

No denial-of-service, load, destructive, social engineering or physical testing.
Third-party hosted assets are excluded from testing.
Findings are shared only with the verified contact and are never published.
You can pause or stop research at any time.

Reporting standard

Reports are written for the engineers who fix issues and for the leaders who need to understand the risk.

Figure 2 · Anatomy of a reported finding (illustrative)

SR-014High

Administrative interface reachable from the internet

Asset: admin.example.com
Evidence: GET /login returned the management console sign-in page with no network restriction.
Impact: An attacker can attempt credential attacks against an administrative interface.
Remediation: Restrict access to the management network or VPN, and require SSO with MFA.
Verification: Confirm the console no longer responds from an external network, then request a retest.

Every finding carries a severity based on exploitability and impact in your environment, the evidence that confirms it, and remediation guidance specific enough to act on.

Reports are delivered by email from noreply@strobes.co to the verified contact only, with a link to view and download the report. The address does not accept replies. Each report email links to a follow-up form for questions about findings, remediation help and retest requests; submissions go directly to the analyst team and are linked to your enrollment.

Third-party disclosure

Modern infrastructure depends on vendors. Issues that belong to them are handled with them.

When research surfaces an issue in a third-party product or service rather than in your own configuration, we handle it through coordinated disclosure with that vendor and keep you informed. Third-party hosted assets are not tested directly under the program.

Eligibility

The program is open to organizations that can show they control the domain they want researched. Analyst capacity is limited, and applications are prioritized where exposure and potential impact are greatest.

Eligibility criteria

01Your organization owns or operates the domain you submit.
02You apply from a work email address on that domain or one of its subdomains.
03You are authorized to request security testing on your organization’s behalf.
04The assets to be researched are reachable from the internet.

About Strobes

Strobes is a Continuous Threat Exposure Management company. More than 150 enterprises use the Strobes platform to discover, prioritize and validate exposures. Strobes was founded by security researchers with a background in top-ranked bug bounty research, and that practice shapes how our analysts and AI agents work.

Transparency

Strobes is a commercial company. This research program sits alongside our paid products, including the Strobes CTEM platform and AI pentesting. Enrolling carries no commercial commitment, and purchasing is not a condition of participation.

Questions

Who can enroll?: Anyone responsible for the security of an organization’s domain, using a work email on that domain or one of its subdomains. Personal and disposable email addresses are not accepted. A Strobes analyst reviews every request, and we may decline requests where ownership or authorization is unclear.
What do you test?: Internet-facing assets on the verified domain that you confirm as in scope during analyst review: domains, subdomains and IP ranges. Research covers asset discovery, exposed services, TLS and email security, leaked secrets in public sources, known CVEs and application-layer issues. Third-party hosted assets are excluded from testing.
Will testing disrupt production?: Testing is designed to be non-disruptive. We do not run denial-of-service, load or destructive tests, and analysts agree exclusions and testing constraints with you during scope review. You can ask us to pause research at any time.
How is my data handled?: We collect the domain, company name and verified email address you submit, along with the findings we produce. Findings are stored in Strobes systems with restricted access, shared only with the verified contact, and never published. Issues affecting a third-party vendor are handled through coordinated disclosure with that vendor.
How will I receive the report?: By email from noreply@strobes.co to your verified address, with a link to view and download the report. Add noreply@strobes.co to your allowlist so reports are not filtered. The address does not accept replies.
How do I ask questions about my findings?: Every report email includes a link to a follow-up form. Use it to ask about a specific finding, request remediation help or request a retest. Submissions go directly to the analyst team and are linked to your original request.
Is there a commercial commitment?: No. Enrolling does not commit you to buy anything. Strobes is a commercial company and this program sits alongside our paid products, but purchasing them is not a condition of the program.

The full conditions of participation are set out in the program terms. Personal data is handled under the Strobes privacy policy.

Applications open

Apply to enroll your organization

Verification takes a few minutes. A Strobes analyst reviews every application and confirms scope with you before any testing begins.

Apply to the program Program terms