24/7 ONLINE · 09:00 → 00:00◆Hacettepe Teknokent / Ankara
+90 536 662 38 09[email protected]
DSETDoğanay Siber Emniyet
  • Services
  • Academy
  • Simulator
  • Blog
    BlogArticles · technical write ups · guidesAnnouncementsLatest DSET news · bulletinsVideo GalleryTraining · demos · cyber security videos
  • About Us
    About UsThe DSET story · vision · teamSimulators and ToolsFree interactive calculators simulators and diagnosis wizardsSector SolutionsFinance · Healthcare · Public Sector · E Commerce · 7 industriesReference CasesReal DSET cases · industry outcomesIn the PressDSET in the national pressSite SearchAll content · articles · services · casesFrequently Asked QuestionsCommon questions · quick answersContactPhone · WhatsApp · address · form
  • Tracking System
    Customer LoginAccount dashboard · request trackingForensics RequestDigital evidence · examination requestData Recovery RequestDisk · RAID · recovery requestPrice CalculatorATK 2026 reference · 9 services
KAOS
TREN
DSETCustomer Panel

Sign in to your account

Request tracking quote approval and your history in one panel.

Loading security verification...
DSET Customer Panel AES 256 GCM encrypted session
DSET AI
//KAOS
Autonomous Offensive Security AI

Maps your attack surface in 5 minutes .
Produces dozens of 0day class findings in 24 hours.

KAOS is an autonomous offensive simulation engine developed in Türkiye by DSET. 72 specialist agents. 276 professional security tools. A 66+ GB living brain that grows every day. A self healing critic architecture. You hand it a URL; KAOS knocks on the target's door gets in finds the flaw recommends the patch · and even tests that patch itself. Every AI model was trained by the KAOS Team. Local inference. No data ever leaves your environment.

Request a Free 5 Minute Preliminary Report Explore the Architecture
  • 5 minfirst findings
  • 24 hoursdeep scan report
  • 72specialist agents
  • 276integrated security tools
  • 66+ GBliving brain growing every day
  • ~9800actively tracked CVEs
  • 100%domestic development
  • 0external API dependency
NVIDIANVIDIA Inception memberDoğanay Siber Emniyet Teknolojileri has been accepted into NVIDIA Inception.View acceptance email ↗

KAOS Nedir?

KAOS, DSET tarafından Türkiye için geliştirilen %100 yerel çalışan otonom yapay zekâ saldırı motorudur. Sıfır API bağımlılığı, kendini onaran kod, KVKK uyumlu veri işleme ve çevrim dışı tehdit analizi sağlar. Yedi yerel modelin (Coder, Critic, Embed Pro, Attack Intel Encoder, Code Encoder, Reranker, Edge) koordineli çalıştığı bir saldırı zekâsı ekosistemidir. Hiçbir trafik dışarı sızmaz, ChatGPT veya bulut AI servislerine veri gönderilmez.

Why is traditional pentesting no longer enough?

A classic penetration test takes 2 to 3 weeks and is run by 1 or 2 people. By the time the report is delivered the CVEs it discovered are already a month old. The modern attacker meanwhile runs automation queues until a single 0day surfaces. Speed is asymmetric. The defense has to answer with automation too.

Human speed cannot match attacker speed

Attackers scan automatically around the clock; a pentester works 40 hours a week. To close this gap KAOS runs like a specialist team that never sleeps all year long. It never tires never asks for a salary and scales.

Knowledge ages

The CVE list in a pentester's head is static. The KAOS brain is fed every hour from NVD CISA KEV MSRC Cisco PSIRT Adobe Oracle SAP VMware Fortinet Apple Atlassian Jenkins Chrome Project Zero and HackerOne. The moment a 0day is published it enters the KAOS arsenal.

Manual patching after a manual report

A classic report states the finding and leaves the fix to the developer. KAOS finds the flaw and recommends the patch. It then tests whether that patch actually resolves the issue using its own adversarial twin. The operator only approves.

KAOS processes a target in 7 phases

Provide a URL as a single page web application a corporate portal an API gateway a cloud account a mobile APK or an IaC manifest. KAOS first classifies the target then runs the pipeline tailored to it.

  1. 01

    RECON · Attack Surface Mapping

    Subdomain enumeration (crt.sh Cymru and DNS). ASN reverse DNS. SSL certificate chain analysis. HTTP fingerprinting. Wayback Machine archives. GitHub leak scanning. Extraction of hidden endpoints and secrets from JS files.

  2. 02

    DISCOVERY · Service and Technology Detection

    Deep Nmap port profiling. httpx fingerprinting. whatweb tech stack. Parameter discovery with katana gau and arjun. JS rendered SPA crawling. GraphQL introspection. WebSocket and gRPC handshakes.

  3. 03

    VULN ASSESS · Vulnerability Detection (46 specialist agents)

    SQLi. XSS (DOM reflected and stored). SSRF. IDOR and auth bypass. JWT manipulation. Deserialization. SSTI. Path traversal. XXE. LDAP NoSQL and OS command injection. Race conditions. Prototype pollution. CSP bypass. CORS misconfiguration. HTTP request smuggling. OAuth SAML and OIDC. AD Kerberoasting and ACL abuse. AWS Azure and GCP privesc. Kubernetes and Docker escape. Solidity reentrancy and flash loans. ICS SCADA. Mobile keystore. Firmware unpacking.

  4. 04

    EXPLOIT · Verified Exploitation (PoC)

    For every HIGH and CRITICAL finding a proof of concept chain is built in an isolated sandbox. sqlmap read only. dalfox no save attack. ffuf. A custom payload diversifier. If the PoC is proven a STILL LIVE seal is applied. After a patch it is retried every 4 hours.

  5. 05

    POST EX · Lateral Movement and Persistence

    Authorization graphs are built with BloodHound (AD) Pacu (AWS) Stratus Red Team (cloud) and Peirates (Kubernetes). Domain Admin chains are visualized from a single POST request.

  6. 06

    DETECT ENG · Detection Engineering

    For every attack a Sigma rule a YARA signature and a Detection as Code test fixture are produced. They can be imported directly into a SIEM. The red team produces; the blue team uses.

  7. 07

    REPORT · Executive Developer and Operations

    A single scan yields three distinct outputs. An executive summary covering business impact. Developer tickets · a unified diff and a unit test for every finding. A SIEM bundle · Sigma YARA and IoCs. In Markdown JSON HTML and SARIF formats.

KAOS is not a simple scanner. It is an ecosystem

The average AI pentest tool wraps a single LLM. KAOS is a distributed reasoning mesh in which 72 specialist agents work in coordination. Each specialist has its own doctrine and arsenal.

Web Application specialist team (12)

  • web_master web_injection web_xss and web_ssrf
  • web_auth (OAuth2 SAML and JWT) and web_idor
  • web_smuggling (CL.TE and TE.CL) and web_cache_deception
  • web_csrf web_clickjack web_open_redirect and web_known_apps

Cloud and Container specialist team (9)

  • aws_pacu (IAM PassRole abuse) azure_recon and gcp_iam
  • k8s_audit docker_escape and cloud_secrets
  • stratus_red (DataDog) and peirates (K8s pod escape)
  • iac_terraform (Terraform Pulumi and CFN drift)

Active Directory and Identity specialist team (8)

  • ad_kerberoast and ad_asreproast
  • ad_unconstrained and ad_constrained_delegation
  • ad_resource_based (RBCD) ad_dcsync and ad_acl_abuse
  • petitpotam_relay (ADCS ESC1 and ESC8 chain)

Mobile IoT and Firmware specialist team (7)

  • apk_static and apk_dynamic (root detection bypass)
  • ipa_static (keychain and entitlement abuse)
  • firmware_unpack (binwalk emba and firmwalker)
  • plc_protocols (Modbus S7 EtherNet/IP and DNP3) ble_recon and can_bus

Code and Smart Contract specialist team (10)

  • semgrep_polyglot (6 languages) and codeguard_cpg (CPG dataflow)
  • solidity_slither solidity_4naly3er and solidity_tealer
  • secret_scanner (TruffleHog and Gitleaks) and dep_confusion
  • supply_chain (SBOM and Sigstore) llm_prompt_injection and config_misconfig

Defensive and Detection specialist team (4)

  • sigma_writer produces a Sigma rule for the detected attack
  • yara_writer produces a YARA signature for binary IoCs
  • threat_modeler builds an automatic threat model with STRIDE and LINDDUN
  • privesc_advisor recommends the shortest patch for IAM AD and Linux

Bug Bounty Specialist team (4)

  • scope_guard rejects out of scope targets
  • payload_crafter produces a disclosure friendly minimal PoC
  • takeover detects and claims subdomain takeovers
  • poc_validator verifies reproducibility against the real target

Skeptic and Adversarial specialist team (4)

  • skeptic challenges the findings of the other specialists
  • red_team_validator runs the real exploit tooling
  • critic_adversary refutes its own critic verdicts
  • referee has the final say when two specialists clash

The 58 specialists above are a representative cross section. The full KAOS team is 72 specialists. The detailed list is provided in an optional technical appendix.

The KAOS brain is a daily growing 66+ GB living security memory

Other AI models only know the world up to their training date then they freeze. The KAOS brain does not freeze. Every hour it ingests deltas from 13 vendor PSIRTs and 22 external feeds. The brain grows on average 2 to 4 GB per day. A 0day enters the KAOS search space within 15 minutes of public disclosure.

13 vendor PSIRTs (LEARN7)

  1. Microsoft MSRC · Patch Tuesday and emergency fixes
  2. Cisco PSIRT · openVuln deltas
  3. Adobe PSIRT · Acrobat and Magento
  4. Oracle Critical Patch Update
  5. SAP Security Notes
  6. VMware Advisories · vCenter and ESXi
  7. Fortinet PSIRT
  8. Apple Security · iOS macOS and Safari
  9. Atlassian · Confluence and Jira
  10. Jenkins Security Advisories
  11. Google Chrome Releases
  12. Google Project Zero
  13. CISA · US CERT NCAS

22 additional feeds (D6 stack)

  1. NVD CVE 2.0 (hourly delta and full corpus)
  2. GitHub Security Advisories
  3. CISA Known Exploited Vulnerabilities
  4. HackerOne disclosed reports
  5. ExploitDB full metadata
  6. Nuclei templates
  7. OWASP Top 10 ASVS and MASVS
  8. MITRE D3FEND ontology
  9. PortSwigger Research RSS
  10. PoC in GitHub annual corpus
  11. CISA ICS Advisories
  12. Slither smart contract detectors
  13. Capa malware analysis rules
  14. Nuclei WordPress templates
  15. Semgrep community and Pro
  16. Audit firm PDF reports
  17. Sigma rules
  18. YARA rules (over 10K)
  19. In house library API documentation
  20. Auto DPO pair generator
  21. Trajectory replay corpus
  22. Cross target memory

The brain technology is a fully domestic hybrid retrieval pipeline

It starts with BM25 classic IR. On top of it sit 3 separate domestic encoders developed by the KAOS Team. KAOS Embed Pro at 1024 dimensions for general text. KAOS Attack Intel Encoder at 768 dimensions for cyber threat intelligence. KAOS Code Encoder for source code. The four rankings are merged with Reciprocal Rank Fusion and KAOS Reranker performs the final ordering. A forgetting curve recency penalty and JSD drift detection are in play. For every query quality_filter the prompt injection scanner and an adversarial KB sweep run first.

No LLM call ever leaves your environment. All inference runs on local KAOS servers with models trained by the KAOS Team. Customer data the customer's domain finding content · none of it leaks to a third party API. It is KVKK GDPR and ISO 27001 compliant. An air gapped deployment is ready.

KAOS works against itself. It questions its own findings

A single AI is in love with its own answer. In KAOS every critical decision is made through the clash of at least two independent minds. The Adversarial Twin architecture has 4 layers.

Layer 1 · Critic Adversary

Does the primary code critic say the patch is valid? A second critic holding the opposite stance reads the same diff and argues why approving it would be wrong. If the two agree a merge happens; if they clash the decision is DEFERred to a human operator. A bad patch never enters the training set.

Layer 2 · DPO Poison Detector

KAOS continuously fine tunes itself generating DPO pairs to do so. The detector scans 5 categories: PROMPT_INJECTION (10 jailbreak regexes) CROSS_PAIR_COLLISION (a reversed chosen and rejected in the same prompt) DEGENERATE_IDENTITY TRIVIAL_LENGTH and NULL_FIELD.

Layer 3 · KB Prompt Injection Scanner

KAOS is fed by public feeds. If an attacker plants a hidden system instruction inside a public CVE description will KAOS read that instruction back during RAG retrieval and act on it? No. The scanner quarantines every document using 10 jailbreak regex patterns.

Layer 4 · Patch Twin

The primary proposer recommends a patch. A second proposer reprocesses the same finding with a different temperature and a different system prompt. If the result is IDENTICAL or EQUIVALENT it is merged automatically; if DIVERGENT or EMPTY it is DEFERred to the operator. Single LLM hallucination is eliminated.

A finding is only the beginning. KAOS patches the flaw itself

A traditional tool states the finding and leaves the rest to you. KAOS produces a verified patch recommendation within 20 minutes of a finding.

  1. 1. Detection

    A vuln assess specialist · web_injection for example · emits a finding.

  2. 2. PoC Verification

    The exploit specialist triggers the chain in an isolated sandbox and applies the STILL LIVE seal.

  3. 3. Patch Recommendation

    The KAOS Coder Proposer a domestic reasoning model produces a unified diff.

  4. 4. Critic Ensemble

    Three separate KAOS critic models (alpha beta gamma) score the diff independently. The CRITIC18 ci_lower defer rule is applied.

  5. 5. Patch Twin

    A second proposer reprocesses the same finding and the diffs are compared.

  6. 6. Apply and Test

    The patch is applied; the existing tests and a new regression test are run.

  7. 7. PoC Replay

    The original PoC is fired again against the patched target. A FIXED verdict is required.

  8. 8. Auto DPO

    The approved patch enters the DPO set with a chosen label; a rejected one is written as rejected.

  9. 9. Cross Target Memory

    The finding pattern is turned into a generic template and found within minutes at the next customer.

Comparison with manual pentesting and other automated scanners

CriterionManual pentest (3 weeks)Typical AI scannerKAOS
First findings1 to 2 weeks30 minutes5 minutes
Deep report3 weeks4 to 6 hours24 hours (dozens of 0days)
Number of specialists1 to 2 people1 LLM72 specialist agents
Tools20 to 305 to 10276 integrated wrappers
Database currencyas the report is writtenweekly feedhourly: 13 PSIRTs and 22 feeds
Patch recommendationgeneral advicegeneric adviceapplicable unified diff
Patch verificationnonenonePoC replay regression
0day discoveryrarenonein every scan series
False positive resistancehuman attentionlow4 layer adversarial twin
SIEM and SOC integrationa separate jobnoneSigma YARA and SARIF automated

KAOS is structurally superior to other AI pentest tools

There are dozens of products on the market claiming autonomous pentesting. Most are a shell wrapping a foreign cloud LLM API around sqlmap. KAOS plays in a different league at the product strategy level. Its 9 structural advantages are as follows.

100% domestic development

All 7 KAOS models · Coder Critic alpha/beta/gamma Embed Pro Attack Intel Encoder Code Encoder Reranker and Edge · were trained in Türkiye by the KAOS Team. We do not depend on any third party AI vendor.

Zero external API dependency

What a customer scans which flaw it finds · none of it is sent to a foreign cloud API. All inference runs on local KAOS servers. Other tools rely on a contract; KAOS makes it physically impossible.

Air gapped deployment

Defense public sector fintech healthcare. The only AI pentest engine that can be installed in environments with no internet access. The brain is an offline mirror; all model files are on prem.

Self improving

Every approval or rejection by the operator fine tunes KAOS Coder overnight. An auto DPO pair generator and an auto train daemon. We sell a living engine not a static model.

Adversarial Twin

With 4 layers · critic_adversary dpo_poison kb_injection_scanner and patch_twin · KAOS questions its own findings. Single LLM hallucination is structurally eliminated.

19 layer CRITIC stack

A self monitoring loop. KAOS measures its own performance and rolls back automatically if it sees regression. The ML Ops concept of model observability applied to a pentest engine.

Anti hallucination doctrine

Every LLM call is wrapped in a three point doctrine: you may say 'I don't know ' prove every fact do not reason without a verbatim quote. It is embedded in the architectural layer.

Cross target memory with ethics

A pattern found at one customer is turned into a generic template so it can be found within minutes at the next. Domains IPs and payloads are not stored; only the structural pattern remains.

A brain that grows every day

Other products' knowledge base is a static library. The KAOS brain grows 2 to 4 GB per day: 13 PSIRTs 22 external feeds and customer learning.

The KAOS of tomorrow. It will grow threefold in 24 months

KAOS is not a frozen product but a roadmap. The 10 main tracks we are actively developing to be integrated into KAOS by the end of 2027 are as follows.

  1. 01

    KAOS Brain Cluster

    Currently a single machine with 9.5 GB ChromaDB. Our end of 2026 goal is a 250 GB distributed brain on a Qdrant cluster. A single scan session is fanned out in parallel across more than 8 hosts.

  2. 02

    144 specialist agents

    Within 12 months we will double the specialist pool: IoT MQTT and AMQP satellite uplink automotive ECU blockchain bridge AI/ML model security industrial robotics OPC UA.

  3. 03

    KAOS Vision

    CSS injection chains via screenshots and the DOM tree. Clickjack overlay detection. Visual CAPTCHA solving. Mobile UI shadow element detection.

  4. 04

    KAOS Audio

    Simulation of IVR and voice biometric bypass. It tests the resilience of the customer's voice based authentication.

  5. 05

    Native autonomous mobile analysis

    Automatic decompilation runtime hooking and keychain inspection for APK and IPA. In 2026 KAOS Mobile will be deployable as a native package.

  6. 06

    AGI tier planning

    We are extending the current 7 phase pipeline to 12 phases. Multi stage attack chain planning hypothesis generation and experiment design (a Markov decision process).

  7. 07

    KAOS Marketplace

    Approved developers will be able to add their own specialist modules to KAOS. A revenue share model. The KAOS Plugin Store.

  8. 08

    KAOS Academy

    Certified KAOS based pentester training. Türkiye's first industry backed AI cyber security academy.

  9. 09

    KAOS Quantum Ready encoder

    A next generation embedding encoder suited to the post quantum cryptography era.

  10. 10

    KAOS Cloud

    A domestic security product on the AWS Azure and GCP marketplaces. An end of 2027 goal of customers across 3 continents.

A customer who subscribes to KAOS today receives every one of these 10 layers at no extra cost. The Sentinel package is a living product model.

0day track record. We sell remediation not just detection

On the customer side KAOS produces between 1 and 5 0day class findings in every scan series. These are flaws that do not appear in any published CVE list.

Our disclosure principle

Every 0day we find is first shared with the customer's vendor. A 90 day coordinated disclosure window is granted; at the end of it a CVE number is obtained. If the customer requests it the brand name is kept anonymous.

Sector distribution

Banking core banking healthcare HIS e commerce B2B PIM public e signature infrastructure crypto wallets OT SCADA HMI. In each one KAOS has produced at least one critical finding: pre auth RCE IDOR and JWT SSRF and cloud metadata chains smart contract reentrancy a Domain Admin path via Kerberoasting.

Our commitment to the customer

We deliver every flaw we find for a customer together with its patch. We never abuse the flaw never sell it never leak it to another customer. Only the general pattern remains in cross target memory.

3 packages. From small validation to enterprise continuous monitoring

FLASH

5 min

Starts the moment you provide a URL · free

  • First surface map (recon)
  • Service and version detection
  • First CVE matches
  • Brief HIGH and CRITICAL report
Start Flash
most chosen

DEEP DIVE

24 hours

Full 7 phase pipeline

  • All 72 specialists fully in parallel
  • Dozens of 0day class findings expected
  • PoC verification for every HIGH and above
  • A unified diff patch recommendation for every finding
  • Sigma YARA and SARIF generation
  • Executive developer and SOC reports
Start Deep Dive

SENTINEL

24/7 continuous

Monthly subscription

  • Hourly recon delta scanning
  • Hourly PSIRT based reassessment
  • Mapping new 0days to the portfolio the moment they go public
  • PoC replay every 4 hours
  • SOC alert webhook and dashboard access
  • Monthly trend report
Request a Sentinel quote

Frequently asked questions

Is KAOS an AI model or an AI system?

KAOS is an offensive intelligence ecosystem in which 7 models we developed entirely in house work in coordination. KAOS Coder performs code reasoning. KAOS Critic alpha/beta/gamma forms a three member patch critique ensemble. KAOS Embed Pro provides 1024 dimensional semantic search. KAOS Attack Intel Encoder is dedicated to cyber threat intelligence. KAOS Code Encoder is for source code. KAOS Reranker performs the final ordering. KAOS Edge is a 4 bit variant for air gapped use. All of them were trained in Türkiye by the KAOS Team all run local inference; no call ever leaves your environment. Hallucination risk is eliminated by the 4 layer adversarial twin.

Can it damage my site during a scan?

The default KAOS mode is read only and passive first. sqlmap runs in batch random agent level 1 risk 1 mode · no exploitation detection only. dalfox runs with no spinner and no save attack mode. nuclei starts with info and medium templates. The scope_guard specialist prevents requests to out of scope targets. Destructive mode is activated only with operator approval.

Do you report a 0day you find to me or to the vendor?

To the customer first. The customer reports it to their own vendor. We provide technical coordination support for the responsible disclosure process and help prepare a low noise PoC. At the end of the 90 day coordinated disclosure period a CVE number is obtained.

Does KAOS speak Turkish?

Yes. All reports and the REPL are written in Turkish. Technical strings · CVE identifiers header names and payloads · are kept in English so the link to Stack Overflow and vendor documentation searches is not broken.

Is a closed air gapped deployment possible?

Yes. This is one of the greatest strengths of KAOS. The Sentinel package has an on prem variant. The brain is an offline mirror kept in sync with current feeds. All inference is done with the KAOS Edge 4 bit and KAOS Coder domestic models; no traffic leaks out. It is ISO 27001 KVKK and GDPR compliant for defense public sector fintech and healthcare.

How does pricing work?

Flash is free; it is the entry point to the service. Deep Dive is priced per scan and scales with scope · number of pages API surface and cloud account count. Sentinel is a monthly subscription; it includes 24/7 monitoring unlimited re scans and a dedicated technical contact. For all prices request a corporate quote at [email protected].

Have your first findings in hand in 5 minutes

Just provide a URL. Let KAOS map the target's surface. Let it send you the first CVE matches. It is free. We do not ask for card details. We work under a signed corporate NDA.

[email protected] 0 (850) 532 00 37Technical documentation

KAOS is developed by DSET Bilgi Güvenliği A.Ş. Trademark registration with the Turkish Patent Office is in progress. © All rights reserved.

DSETDoğanay Siber Emniyet

Digital Forensics · Data Recovery · Cyber Security · Information Security · Technical Examination · Expert Opinion · KVKK & GDPR Compliance · Digital Transformation Consulting · advanced training programs offered by DSET Academy.

NVIDIANVIDIA Inception memberView acceptance email ↗
+90 536 662 38 09[email protected]Hacettepe Teknokent · Üniversiteler Mah. 1596. Cad. 6. AR GE Blokları C Blok No:6C Z.Kat · Beytepe · Çankaya · ANKARAOur Google Business Profile7/24 Online · 09.00 → 00.00 · Pazartesi · Pazar

Our Services

  • Adli Bilişim
  • Veri Kurtarma
  • KAOS Yerel Yapay Zekâ
  • Siber Güvenlik
  • KVKK GDPR Danışmanlık
  • DSET Akademi
  • Olay Simülatörü & Tehdit Heatmap
  • Web Sitesi Güvenliği
  • Bilgi Güvenliği
  • Adli Bilişim Benchmark'ı

Support & Help

  • About Us
  • Press Room
  • Price Calculator
  • Frequently Asked Questions
  • Contact
  • EU AI Act Article 4 Guide
  • Sector Solutions
  • KVKK Disclosure Statement
  • GDPR · EU Data Rights
  • Privacy Policy
  • Cookie Policy
  • Terms of Service

Quick Links

  • Solutions
  • DFB Benchmark
  • Blog
  • Video Gallery
  • DSET Academy
  • Case Simulator
  • Reference Cases
  • Hotel Management System
  • DSET AI Assistant

Ecosystem

  • Hacettepe Teknokent
  • Cyber Security Cluster
  • USOM · National Cyber Incident Response
  • KVKK Authority
  • llms.txt
© 2026 dset.com.tr · Doğanay Siber Emniyet Teknolojileri · All rights reserved.
“Kalite asla tesadüf değildir...”
TREN
Home
Services
Site Search
Digital Forensics Request Form
Data Recovery Request Form
Customer Login
Privacy
KVKK
GDPR
Cookies
Terms