Straight answers, including the unflattering ones.

Three structural differences. First, every reported finding carries gate-verified evidence, not pattern-match suspicion — we demonstrate it before we report it. Second, the platform proves its own capabilities are real and wired in, so "no findings" means tested-and-clean rather than silently-broken. Third, the dual-engine architecture pairs a reliable deterministic core with an attacker-reasoning AI layer, so you get stable coverage and creative discovery without having to trust either one blindly.

By design, the rate of false-positive proven findings is near zero — that's the entire point of the proof system. Anything we can't prove isn't reported as proven.

The honest trade-off is coverage, not accuracy. A weakness that fails one of the four gates isn't reported as proven even if it may be real. We deliberately err toward under-reporting rather than over-reporting. If you want a tool that shouts about everything it suspects, we're the wrong choice.

Three to twenty minutes for a typical mid-sized target, depending on surface size and whether the AI brain is enabled. Brain-enabled runs are slower because each decision involves an LLM call. The Live Trace view shows phase-by-phase progress in real time.

Yes. Authenticated testing is where much of the real risk lives, and GhostTrace probes behind the login today when credentials are provided for the engagement — the flaws a public-surface-only scan can't reach, like cross-tenant access between logged-in users.

Deeper integration is rolling out. Turnkey SSO (OAuth, SAML) and vault-resolved credentials — so we never hold a long-lived secret — are rolling out with design partners rather than self-serve yet. If that's a hard requirement for you, tell us and we'll walk through where it stands.

Yes. The scope allowlist is fully customizable — which targets, which URL patterns, which time windows. Detector selection is customizable through the manifest, and the AI brain's posture (off, conservative, aggressive) is configurable. Custom detectors can be added under the standard registration pattern.

Two answers. One: you don't have to. Deterministic mode disables the brain entirely, and the deterministic layer is a complete product on its own.

Two: the brain is measurement-instrumented. Every brain decision is scored against structured criteria and recorded in the activation ledger — so its quality is assessed run over run rather than taken on faith. And crucially, the brain never gets the last word: whatever it proposes still has to clear the same evidence gates as everything else before it reaches you.

So you get the creativity of an attacker's reasoning with none of the "trust me" — the AI is audited, and the proof system is the referee.

Yes, and it's enforced in code, not by a setting — the cost governor hard-blocks AI calls when the mode is deterministic. For regulated environments, sensitive data scopes, or simply for fully reproducible scans, deterministic mode is the recommended posture.

Comprehensively. The activation ledger records every capability invocation with inputs, outputs, and timing. The scope ledger records every authorization decision and its rationale. The trace log records the run timeline. Evidence bundles preserve the raw request and response for every proven finding. Together, you can reconstruct exactly what the platform did and why.

Turnkey SSO & vault integration for authenticated testing is still rolling out. We probe behind the login today when credentials are provided; self-serve OAuth/SAML and vault-resolved credentials are landing with design partners first.

Also: coverage gaps across several OWASP API Top 10 classes, cloud-posture checks on the roadmap, access-control detection currently keyed to numeric IDs, and file-based (not yet real-time) integrations. The full list lives on the Trust Center.

Not without authorization. The scope governor is the structural answer: every request is checked against your allowlist before it leaves the platform, in code, at three independent layers. Out-of-scope requests are blocked and logged. Scope can be tightened mid-run but never widened — widening requires re-authorization.

Safety is architecture, not a human watching over it. The scope governor enforces a hard allowlist on every request, fail-closed; the cost governor caps each run so it can't run away; the dry-run previews exactly what will happen before any real probing, fully logged; and execution is entitlement-bounded to what you signed. Active probing is rate-limited and non-destructive, paced to spare production — and the scope ledger lets you audit every request after the fact.

Authorization is established outside the platform — your engagement letter, MSA, or rules-of-engagement document — and encoded into the scope allowlist. GhostTrace doesn't generate authorization; it consumes yours. No signed scope, no probes.

Minimal. Launch a run and watch the live trace if you want — findings arrive already gate-verified and adjudicated, so there's no required review step in the loop. Because only proven findings surface, what reaches you is short by design. A one-off run is a few minutes of operator time plus scan time; ongoing assessment is light-touch.

Hosted, multi-tenant SaaS — you reach it over TLS at a per-customer dashboard URL, nothing to install. Your data is isolated at the database layer by row-level security, so it's never visible to another tenant. If you need physical isolation (regulated environment, data-residency constraint), a dedicated single-tenant instance of the same stack is available.

Run artifacts: findings, evidence bundles for proven findings, the activation and scope ledgers, and the trace log. Raw response bodies are preserved only in evidence bundles for proven findings — non-proven candidates don't retain full bodies. Retention duration is operator-configured. Data leaves the platform boundary only when the AI brain is enabled (LLM calls) — which deterministic mode removes entirely.

File-based today: every run produces structured artifacts (results.json, activation_ledger.jsonl) at known paths that downstream tools consume. API-based and webhook-based integration are near-term roadmap, and specific integrations (Jira, ServiceNow, Splunk, Sentinel, Tenable, Qualys, Rapid7) are prioritized by design-partner demand.

The platform produces audit-grade artifacts (activation ledger, scope ledger) that support compliance use cases. Certifications for CySecTrust as a vendor are in preparation — our SOC 2 program is underway and we'll say so plainly rather than imply otherwise. The verification discipline itself tends to land well with auditors: a tool whose self-description is structurally enforced is easier to certify than one whose claims are just documentation.