Once attacks are automated with AI, defense needs the same level of automation. Chitos is a sovereignty-first security audit engine: it probes the same checklists an attacker would use, verifies each finding once more with AI, and is designed so that a customer's code and data never leave their own network.
Why an AI security audit now
In autumn 2026, seven financial institutions in Korea were breached by a single open-source AI penetration tool, and roughly 65,000 customer records were exfiltrated. The attack path was not exotic: SQL injection in a peripheral web application, authentication bypass, and bulk personal-data harvesting through sequential record access. What changed was speed and autonomy. Once an attack runs itself, the defense has to run itself too.
That is the question Chitos starts from.
The three layers of Chitos
Chitos is not a single scanner. It works in three layers.
- Autonomous audit agent: it reads the reconnaissance output and forms its own audit hypotheses. When one path is blocked, it researches another and breaks through. It widens coverage without a human spelling out each step.
- Detection engine (non-destructive): it checks web vulnerabilities (injection, authentication, access control, exposure) along with supply chain, secrets, and configuration, without damaging the target. It integrates proven open tools and adds its own probes on top.
- AI second-stage verification (metacognition): the AI re-reads the first-pass findings and filters out false positives. That is a level of confidence a plain scanner cannot reach.
The input is source code and an authorized target URL. The output is a reproducible evidence report.
OWASP Benchmark
The OWASP Benchmark is an official evaluation set that measures a security tool's accuracy on about 2,700 test cases, as a Youden index from 0 to 100. The following are Chitos self-measured results.
| Configuration | Youden index |
|---|---|
| Base code scanner alone | 52.8 |
| Chitos full, online judgment engine (Claude Opus 5.5) | 77.2 |
| Chitos full, on-prem judgment engine (Darwin-180B-RSI) | 77.8 |
The AI verification layer is the key. From 52.8 before verification, the AI removes more than 60 percent of false positives while missing none of the real vulnerabilities, lifting the score into the high 70s. The external API engine (Claude Opus 5.5) at 77.2 and the on-network engine (Darwin-180B-RSI) at 77.8 were effectively identical. Publicly reported commercial tools fall in the mid-70s and above, and these self-measured figures land in that range. These numbers are self-measured, with cross-validation through the official scoring tool in progress. We state only what has been measured.
Data sovereignty: the same level on-prem
The Chitos judgment engine runs in two forms: an external API model, and a large model deployed inside the customer's own network. On the same OWASP measurement the two configurations scored effectively the same. In other words, auditing entirely inside the network, with no data sent outside, does not cost performance. That fits finance and public-sector environments where data must not leave the premises.
Compared with commercial scanners
We audited public vulnerable web applications under identical conditions with Chitos and with a mature open-source scanner. Raw detection breadth was comparable, and Chitos led in three places.
- Chitos caught the logic vulnerabilities that target finance (access-control bypass, authentication bypass, over-exposure via sequential access) that the traditional scanner missed.
- Chitos does not damage the target. Active attack-style scans can take a running system down.
- Chitos finds the audit points on its own. Traditional tools often need a human to specify each one.
Automation that keeps up with today's vulnerabilities
Security goes stale within a day. Chitos refreshes thousands of public vulnerability fingerprints automatically every day. For an urgent new vulnerability not yet in the fingerprint database, it responds the same day with a dedicated detection rule. A recently disclosed PHP engine remote-execution flaw, for example, is invisible to any code-analysis-only tool, yet Chitos identifies exposure from the target's version fingerprint and guides the patch.
Strengths in brief
- A shield that understands the attack: it retraces the exact attack chain that breached real financial systems, as a pre-audit checklist.
- Non-destructive: an audit does not turn into an incident.
- Data sovereignty: commercial-grade performance inside the network, with no exfiltration.
- Autonomy and AI verification: it audits on its own and filters out false positives.
- Daily refresh: it keeps up with today's disclosed vulnerabilities, today.
Closing
Chitos is not a finished product; it is an engine proving itself quickly. Self-measurement has reached the upper commercial range, and official cross-validation and field references are hardening that confidence. Security should speak in evidence, not promises. Chitos is stacking that evidence as numbers.
Free consultation: https://vidraft.net
Top comments (0)