Products
Platforms we build alongside our services — live, in beta and in design
Our platforms encode expertise, methodology, and operational knowledge into scalable systems to enable and amplify security services.
Our Platforms
Each product answers one security question; its stage is marked on its card
Which Product Answers Which Question
Start from the question you cannot answer today
| Product | The question it answers | How you use it |
|---|---|---|
| VAaaSBeta | Are our applications secure, and can we prove what was tested? | Our assessors today; the platform is in development |
| ASMBeta | What do we expose to the internet, and who owns each of those things? | Beta, with design partners |
| Asset ManagementBeta | What do we actually have, how sure are we of each record, and can we prove where it came from? | Beta, with design partners; built for your own infrastructure |
| APEAIn design | Does the protection in front of our applications actually stop attacks? | In design; measured today by our WAF assessment service |
| AI-Driven Pentest PlatformIn design | How do we test more often than an expert engagement allows? | In design; penetration testing is delivered as a service today |
| HafezCTFBeta | Who on this team, or in this candidate pool, can actually do the work? | Early access (private beta): our hosted instance, or yours with your branding |
| Hafez AcademyBeta | How do we build these skills in our own team, from the ground up? | Hosted academy, early access (waitlist) |
| Hafez Fabric | How do we use AI across the organization without our data leaving it? | Self-hosted; designed to run with no route to the internet |
Why Our Platforms?
Products and services catalogue
Every HafezSecure service and product in one 16-page document: ready to print, to send on, or to attach to a proposal.
16 pages A4 · PDF
Frequently Asked Questions
About the platforms and how they are used
Start from the question you cannot answer today. If nobody can list what the organization exposes, start with ASM. If applications are tested once a year and nothing survives between engagements, start with VAaaS. If your WAF is configured and nobody has measured it, start with our WAF effectiveness assessment. If the problem is people rather than systems, start with HafezCTF.
Academy will build the skill; HafezCTF measures it. Academy, now in early access, will teach cybersecurity from zero with structured lessons and browser-based labs, so a person who could not do the work learns how. HafezCTF runs assessment-grade competitions with per-participant flags and qualification reports, so you can see who on a team, or in a candidate pool, can actually do it. The idea is to train on one and prove it on the other.
No. Each product answers its own question, and those that are available are offered on their own; the two in design are not for sale yet. They share an asset inventory and a finding lifecycle where that helps, so using two is less work than using two unrelated tools, but nothing requires the set.
Hafez Fabric is self-hosted: it runs on servers you control, and it is designed to run on networks with no route to the internet. The platform modules (VAaaS, ASM and Asset Management) are designed the same way; they are in development, not yet deployed anywhere, and we are looking for design partners. The two products in design would follow the same model.
Beta means the product is early. For the platform modules it means built but not yet deployed: we take on a small number of organizations as design partners and work closely with each. For HafezCTF and Hafez Academy it means early access: a private beta for invited users, opening to the public later. Either way, what you do not get is a self-service product with every edge case already handled. In design means a concept: the page describes the design, and nothing is built yet.
The services are the work our experts do; the platforms are what we are building for that work to run on. Today you buy the service. As the platforms are deployed, you will also be able to take a platform and run the work yourself, or mix the two.
No. Our platforms are designed to run their AI features through Hafez Fabric, which can mask sensitive values before any request reaches an external model, and an installation can be restricted to models running inside your own network.
A conversation about the question you are trying to answer, then a demonstration on real data of yours where that is possible, then a written scope. Nothing is tested and nothing is installed before that is agreed.
Reports and our work with you are in Persian or English, as you prefer. Product interfaces vary: some are English today with Persian coming, and we say which on each product page rather than promising a translation that does not exist yet.