Use Cases

Twelve scenarios. One appliance.

Each use case is a buyer pain mapped to a Zero Hunt workflow. Three per pillar: scenario, pain, solution, outcome, time-to-value. Each has its own anchor — link a colleague straight to the one that matches their conversation.

Pillar 1 — Generative Pentest

Continuous offensive validation. AI-generated exploit code per target.

Replace the annual pentest with continuous validation

⌛ 30-day ROI vs annual contractor cost

Scenario: You pay €50-150k/year to a pentest contractor and the report is obsolete within weeks of delivery.
Problem: Manual pentest gives a snapshot. By the time the PDF lands, the attack surface has changed: new IPs on the perimeter, new services, new credentials. The next regulator-facing event is six to twelve months away, and your evidence is already stale.
How Zero Hunt solves it: Schedule continuous campaigns on the appliance — daily, weekly, or change-triggered (new IP, new service, new credential). The 10-agent swarm runs autonomously; every finding is signed and timestamped. Senior pentesters still drive threat-led campaigns through the Interactive Red Team Chat for the judgment calls that humans do better.
Outcome: Replaces 1-2 FTE-equivalent of pentest contractor hours per month. Evidence is current at every regulator-facing event, not just at audit time. Time-to-validate a new asset drops from "next engagement" to "within the hour".

Goes deeper:Finance · DORA Art. 25 →Utilities · NIS2 →NIS2/DORA & the end of the annual pentest →

Validate exposure to a high-severity CVE within hours of disclosure

⌛ Hours, not quarters, per critical CVE

Scenario: A critical CVE drops at 22:00 (CISA KEV addition, vendor advisory, mass-exploitation report). Your stack is on the affected version. Now what?
Problem: The standard answer is "wait for the next scheduled pentest", which can be quarters away. Patching alone tells you the version changed but not whether the path was actually exploitable in your environment. Without proof, the board question "are we vulnerable?" has no defensible answer.
How Zero Hunt solves it: The appliance ingests CISA KEV, NVD, vendor advisories continuously (21 intel sources). When a relevant CVE drops, the 10-agent swarm generates an exploit specific to your environment, runs it in sandbox against your inventory, and produces a signed proof-of-exploit (or proof-of-non-exploitability) artifact. Often before the morning standup.
Outcome: Time from CVE disclosure to defensible exposure verdict drops from quarters to hours. The board question gets a yes/no with evidence attached, not a probability.

Goes deeper:Utilities · NIS2 →Healthcare →CVE-2026-20182 + 31431 case →

Run threat-led TLPT campaigns aligned with TIBER-EU for DORA Art. 26

⌛ Same-quarter TLPT cycle vs 3-year minimum

Scenario: You are a significant DORA entity (bank, insurer, payment institution) required to run threat-led pentests using documented methodology, with signed evidence from threat intelligence input through to closure.
Problem: External TLPT contractor engagements cost €150-400k each, scope is fixed at procurement time, and the methodology audit trail is assembled by hand. A second engagement same year is rare even when the threat landscape changes materially.
How Zero Hunt solves it: The appliance runs TIBER-EU-compatible TLPT campaigns informed by 21 live threat-intel feeds. Methodology phases (TI provisioning → red team test → purple team → closure) are tracked natively; every artifact is signed and hash-chained in sequence, producing a verifiable chain back to the threat-intel input. The RTS 2025 evidence requirement becomes a query, not a project.
Outcome: TLPT-grade evidence on demand, not once every 3 years. Cost per campaign collapses to compute time. The EBA/Banca d'Italia audit conversation moves from "where is the documentation?" to "which window?".

Goes deeper:Finance · DORA Art. 26 →vs Pentera (TLPT) →DORA + NIS2 deep dive →

Pillar 2 — AI Traffic Analysis

Wire-speed detection of the activity that endpoint stacks miss.

Catch ransomware during encryption, not after

⌛ Seconds-to-detect vs hours-to-days

Scenario: You operate a hospital, a manufacturer, or any 24/7 environment where Q1 2026 median time-to-impact is under 48 hours and the encryption phase, once started, is over in 90 minutes.
Problem: Endpoint signals fire during the encryption phase but by then it is too late: files are locked, backups are racing the ransom note, and the next 6 hours are crisis communications. SIEM batch cadence (15-minute windows on 24h queries) misses the burst entirely.
How Zero Hunt solves it: Pillar 2 is a 4-head deep-learning model running on the appliance GPU at 2.7+ Gbit/s baseline. It detects the behavioral signature of in-progress encryption — rapid SMB/NFS write fan-out, predictable lateral patterns, the preceding privilege-escalation traffic — while the activity is happening. Output goes to your SOAR within seconds; the file-share connection can be cut before the encryption completes.
Outcome: Mean detection latency drops from hours-to-days to seconds-to-minutes for the encryption phase specifically. Recoverability window opens before encryption completes.

Goes deeper:Healthcare · ransomware target #1 →vs Cymulate (simulation vs detection) →Encryption-less ransomware 2026 →

Detect mass data exfiltration while it is in progress

⌛ Detection during the burst, not the morning after

Scenario: You are facing the 2026 trend: ransomware affiliates skip encryption entirely and go straight to silent mass exfiltration, then extort on the threat of publication. The endpoint sees legitimate reads. The SOC sees nothing.
Problem: Volume-based DLP misses staged exfiltration (attacker stages inside the perimeter, then moves out spread across hours via legitimate CDN ranges). TLS inspection has retreated under HSTS preload + ESNI + QUIC. Your only durable signal is the network egress — and most defenders are weakest exactly there.
How Zero Hunt solves it: The deep-packet ML model classifies flow metadata (timing, fan-in/out, byte distribution, ASN destination, JA3/JA4 hashes) as packets traverse. A host that flips from net-importer to net-exporter, a sustained outbound burst to a never-seen ASN, an SD-WAN tunnel carrying 10× its usual volume — all light up during the burst, in time to cut the link.
Outcome: Discovery happens during the exfiltration window, not the morning after when the data is gone. Regulator countdowns (GDPR Art. 33, NIS2 Article 23) run from awareness, and awareness that comes during the exfiltration, not after it, is a date you can defend.

Goes deeper:Healthcare · GDPR Art. 33 →Finance · DORA Art. 17-22 →Exfiltration-only ransomware deep dive →

Unmask covert C2 over TLS, DNS tunneling, and domain fronting

⌛ Minutes-to-detect on novel C2 protocols

Scenario: Your EDR is signature-based. Your NDR is rule-based. Both miss command-and-control traffic that mimics legitimate behavior — HTTPS beacons, DNS-over-HTTPS tunnels, traffic fronted through your own CDN provider.
Problem: AI-augmented affiliates rewrite C2 protocols per campaign. Static signatures expire on first contact. Rule-based detection requires a known pattern. The actual signal — beaconing periodicity, jitter, fan-out, certificate fingerprint anomalies — is not seen by either layer.
How Zero Hunt solves it: One of the 4 inference heads is dedicated to attack-type identification, trained on billions of labeled PCAP sequences including covert C2 traffic patterns. The model classifies on flow metadata alone — works fine against encrypted payloads, no TLS inspection required. JA3/JA4 fingerprint scoring catches the "looks-legitimate-but-isn't" cases.
Outcome: C2 channels surface within minutes of activation, regardless of protocol family or fronting strategy. Threat-hunting team gets a high-confidence shortlist instead of a million alerts.

Goes deeper:Defense supply chain →vs Cymulate →

Pillar 3 — Automatic Compliance

Continuous, signed, regulator-ready evidence by construction.

Produce NIS2 Article 23 incident evidence as a byproduct of operations

⌛ From multi-day per-incident to single-query

Scenario: You are an essential or important entity under NIS2 (in Italy, decreto legislativo 138/2024). Every significant incident triggers a 24-hour early warning, a 72-hour notification and a final report within a month, counted from when you become aware of it.
Problem: Assembling Article 23 evidence by hand is a multi-day exercise per incident: timeline reconstruction, control mapping, signed export, regulator-format conversion. The competent authority — ACN in Italy — expects continuous evidence of effective measures, not annual snapshots.
How Zero Hunt solves it: Every action — scan, finding, traffic event, remediation — is signed at write time and auto-mapped against the NIS2 Article 21 and 23 controls. The Trust Center exports a regulator-ready bundle in one click. The 24h / 72h / 1-month timeline becomes a query against signed records, not a fire drill.
Outcome: Notification timeline compliance becomes a queryable workflow. The auditor conversation moves from "show me the documentation" to "select a date range". Management bodies, personally accountable under NIS2 Article 20, get a signed record of what was known, what was done, and when.

Goes deeper:Utilities · NIS2 essential →Italian PA · decreto 138 →NIS2 + DORA deep dive →

Map findings against 34 frameworks in a single pass

⌛ ~70% reduction in cross-framework duplicate work

Scenario: You face concurrent audit regimes — NIS2 + DORA + GDPR + ISO 27001 + PCI-DSS + SOC 2 — that share underlying controls but require their own evidence formats.
Problem: GRC teams maintain parallel evidence chains, one per framework. The same finding gets manually re-mapped 3-6 times. Cross-framework deduplication is theoretical; in practice the work is multiplied by the number of regimes in scope.
How Zero Hunt solves it: The compliance engine auto-maps every finding against 34 frameworks with cross-framework control deduplication built in. Severity-weighted scoring per framework reflects each regulator's materiality model. Reports are generated per framework from the shared signed record store.
Outcome: Redundant audit work drops by up to 70%. One finding satisfies multiple frameworks without manual re-mapping. Multi-regime entities convert from "build evidence for each audit" to "publish slice of the record store per audit".

Goes deeper:Finance · multi-regime →Italian PA · NIS2 + AgID →

Auditor bundle export — signed, verifiable, repeatable

⌛ Single-click export vs multi-day assembly

Scenario: Audit cycle starts. Auditor asks for "all evidence related to control X.Y.Z for the period of Q1". You have 5 days to assemble it from logs across SIEM, SOAR, EDR, GRC, ticketing.
Problem: Manual evidence assembly is the single largest GRC time-sink. Authenticity is questioned (was the screenshot manipulated?). Chain-of-custody is narrative, not provable. Cross-tool reconciliation introduces errors that auditors then dig into.
How Zero Hunt solves it: Trust Center exports a self-contained, ECDSA-signed bundle scoped to controls + period + framework. Bundle includes findings, evidence files, traffic events, remediation logs — every artifact carries its original write-time signature. Auditor can verify cryptographically without trusting our infrastructure.
Outcome: Audit preparation collapses from days to a single export action. Auditor questions on authenticity / chain-of-custody are answered by cryptographic verification rather than narrative.

Goes deeper:Defense · CMMC/TRANSEC →Italian PA · AgID/ACN →

Pillar 4 — AI Remediation Advisor

From proven finding to verified fix, ranked by real risk.

Fix what was proven exploitable, in the order that matters

⌛ A ranked fix plan as soon as the campaign ends

Scenario: Your last assessment produced hundreds of findings, and your team can close a few dozen this month.
Problem: A list sorted by CVSS puts theoretical criticals above the flaw an attacker actually used, and possible false positives eat the same hours as real ones. Three hosts running the same outdated library show up as three tickets, and nobody can say which fixes cut the most risk.
How Zero Hunt solves it: The AI Remediation Advisor works only on findings the campaign proved: verified or exploited. It ranks them by real exploitability — CISA KEV first, then what was exploited in this campaign, then CVSS, EPSS and severity — merges them by CVE into remediation actions and groups those into P1–P4 waves, quickest high-impact fixes first.
Outcome: The first wave closes the paths an attacker could use today, not the ones that merely score high. No effort goes to unconfirmed findings, and each action covers every host it affects.

Goes deeper:Playbook: KEV emergency patch window →Enterprise · lean security teams →

Verify each fix with the same proof that found the flaw

⌛ Fix verified the day it ships

Scenario: A critical finding has been patched, and the auditor — or your board — asks how you know the hole is closed.
Problem: Generic advisories say "upgrade", not which endpoint, parameter or payload the fix has to stop. Re-testing waits for the next engagement, so "fixed" is a ticket status rather than a demonstrated fact.
How Zero Hunt solves it: When the Exploit Forge produced a proof of concept for the host, the advisor reads it before proposing the fix, so the fix targets the real path: the endpoint, the parameter, the payload — and the file and line when the agents had source access (gray box). Every fix ends with a Verify step; re-running the same proof, or the campaign against that host, shows whether the exploit still works.
Outcome: Closure is demonstrated the day the fix ships instead of at the next annual test, and the re-run campaign leaves signed evidence of it for the audit file.

Goes deeper:Black box vs gray box →Finance · DORA remediation evidence →

Give a lean team a senior engineer's fix plan

⌛ From finding to a reviewable fix script in one conversation

Scenario: You run security with two or three people across Linux, Windows, containers and a web tier, with change windows you do not control.
Problem: "Upgrade to version X" does not say how to roll it out safely, what to do until the maintenance window, or how to back out if the service breaks. Writing that plan for every finding is senior work the team has no time for.
How Zero Hunt solves it: For each item the advisor gives the root cause, the exact fix, copy-paste commands for your platform, a safe-rollout note with the rollback step, and a compensating control to apply now if the real fix must wait. On request it writes an idempotent fix script — bash, PowerShell, Ansible, Dockerfile or web-server config — that backs up every file it changes and ends with a PASS/FAIL check. Your engineers review and run it: the advisor has read-only tools and never executes anything.
Outcome: Every change ships with a rollback path, and each fix is mapped to the control it satisfies — ISO 27001 Annex A, NIS2, DORA, GDPR Art. 32, PCI DSS, CIS — for the audit file.

Goes deeper:Enterprise · 1-2 FTE security teams →Utilities · change windows →

See it against your environment

Pick the use case closest to your current pain and we will scope a 30-minute technical demo against a recorded slice of your stack.

Request a demo Browse industries

Not ready for a demo?