Research

Revelion Labs

We publish what we find: attack chains, benchmark results, and the methodology behind both.

What Labs is for

If a claim cannot be checked, it does not belong on this site

Revelion Labs is where we publish the work behind the product: how attack chains are constructed, how the agent reasons about a target, and how it performs against environments anyone can inspect.

That serves two purposes. It is the technical proof a buyer is entitled to before trusting an autonomous agent against their estate, and it is a standing check on our own marketing, because published methodology is harder to overstate.

Benchmarks

Measured against environments you can inspect

Results, the methodology used to produce them, and the scoring so the numbers can be interrogated rather than taken on trust.

Benchmark resultsHow Revelion performs, and exactly how that was measured.MethodologyThe phases a mission runs through, written out in full.

Attack research

Write-ups

Analysis of how weaknesses combine into access, and what that means for the estates that carry them.

What is Autonomous AI Pentesting?A comprehensive guide to autonomous AI penetration testing: how intelligent agents perform reconnaissance, exploitation, and reporting without manual intervention, with real benchmark results.AI vs Manual Pentesting: 10 Things We LearnedAI pentesting and manual pentesting are not a simple replacement story. Here are ten practical lessons on where each model wins, where each struggles, and how security providers should combine them.The Margin Math on Managed Pentesting for MSPsA practical margin model for MSPs turning pentesting into a managed service: package pricing, platform cost, delivery time, and the economics behind recurring security assurance.MSSPs vs Consultancies: Where Pentesting FitsA practical guide to how MSSPs and security consultancies differ, where their scope overlaps, and how AI pentesting can help both models turn offensive security into a scalable service.Why MSPs Lose Pentest Deals to Consultancies (And How to Win Them Back)MSPs often refer pentest work to consultancies and watch the relationship drift. The reasons are structural, not technical. Here are the four operating-model gaps and the four counter-moves to bring the pentest line back inside the MSP relationship.AI Pentesting vs Vulnerability Scanning: What Actually ChangesVulnerability scanners check for known signatures. AI pentesting thinks, adapts, and proves exploitability. Here's what actually changes, and why it matters for your security posture.How AI Agents Chain Vulnerabilities: From Recon to RootHow autonomous AI agents discover, correlate, and chain low-severity findings into critical attack paths, with three real-world patterns scanners miss.SSTI to RCE: Template Injection Exploited in 60sStep-by-step: how Revelion discovered and exploited a Jinja2 SSTI to achieve RCE in 47 seconds, from initial probe to proven file system access.

Everything here is checkable. Start with the method.

Read the benchmark method