KYE Offensive Security Authority Pack™ — capability is not authority.
When a penetration tester fires an exploit, tests a live credential, lets an autonomous AI pentest agent act, discloses a vulnerability, or commits a patch — a capable tool did something consequential. The tool supplied the capability. The open question a CISO, a regulator, and your own counsel ask afterwards is different: was this action authorised? The KYE Offensive Security Authority Pack™ governs that action boundary: it binds every consequential offensive action to a named authoriser, scopes it to the agreed rules of engagement before the action, holds it advisory until a named authoriser signs off — two-person on production-impacting exploitation — and seals it into replay-provable Authority Finality™, cutting after-the-fact engagement-authorisation evidence work from days to minutes. KYE Protocol™ governs whether the offensive action may proceed — it does not run the scanner, fire the exploit, execute the pentest, or judge whether a finding is a true vulnerability.
Capability is everywhere — authority is the missing layer.
Autonomous pentest agents, exploit frameworks, credential-testing tools, and red-team platforms now produce offensive actions faster than any human can pre-authorise them. Firms like CyberVelX supply formidable offensive-security capability. The high-value problem is not whether the tool can act — it is whether the action was authorised. Four facts converge:
- The consequential moment is the action, not the finding. A scanner result is inert; an exploit fired at a live system, a credential tested against a production account, a vulnerability disclosed, or a patch committed is consequential. That is where legal exposure — unauthorised-access liability — and reputational risk attach, and exactly where governance is weakest.
- The methodologies already exist; the enforcement of authority does not. The Penetration Testing Execution Standard (PTES) pre-engagement interactions, OSSTMM engagement scope, NIST SP 800-115 rules of engagement, the OWASP WSTG, and CREST authorisation-and-scoping all say what a test requires. KYE Protocol™ governs whether an offensive action may proceed under those methodologies, under whose authority, within which agreed scope.
- Provenance is now a client and assurance expectation. An exploit fired, the scope it fell under, and the authoriser who approved it each must carry documented lineage (NIST SP 800-115 test-record retention; CREST evidential records). KYE Protocol™ produces a signed, replay-derivable provenance pin at the moment the action commits.
- This is a governance wedge, not an offensive-security engine. KYE Protocol™ does not compete with CyberVelX, the exploit frameworks, or the AI pentest agents. It governs the action boundary they feed — the named-authority, agreed-scope, two-person sign-off, and provenance layer the offensive-security ecosystem currently lacks. Capability ≠ authority.
Survives an assurance auditor, a client dispute, or a regulator spot check — scoped, two-person-signed-off, and derivable from public keys alone.
- Scoped by construction. An offensive action that moves toward an exploit, credential test, disclosure, or patch must fall inside a recorded authorised scope and rules of engagement determined before the action — with the out-of-scope and production-impact exclusion checked. An out-of-scope, expired-window, or scope-deficient action is refused at the Action Admissibility™ gate.
- Sign-off-gated, two-person on production impact. An action stays advisory until a named authoriser — the commissioning CISO, the system owner, or the engagement authoriser — records sign-off. Production-impacting exploitation additionally requires two-person sign-off: the operating tester and an approving authoriser. Unreviewed production-impacting actions are refused and routed dual-channel.
- Authority-bound. Every consequential action maps to a recorded named-authority engagement decision — the actor, the offensive artefact, the intended action, and the named authoriser under whose authority it proceeds. An AI pentest agent authorised for one scope cannot proceed under another.
- Replay-provable provenance. A signed provenance pin binds the actor and model, the exploit or payload identity, the tested systems and tool version, the authorised-scope determination, and the authority outcome — audit-grade lineage an assurance auditor or a regulator can verify offline, against published keys alone, satisfying NIST SP 800-115 record retention and CREST evidential requirements.
- Methodology-anchored. PTES, OSSTMM, NIST SP 800-115, the OWASP WSTG, and CREST each map to a control row — with a 90-day attestation cadence.
Seven modules, one spine — authority-bound at the action boundary.
One coherent Offensive Security Authority spine governs six specializations — pentest-engagement, exploit-scope, credential-test, ai-pentest-agent, vuln-disclosure, and patch-authority — with no parallel packs. Each offensive action that moves toward a consequential action flows through the same authority rules, on the canonical KYE Protocol™ envelopes.
- 1 — Engagement Authority Map. Before any offensive action, the engagement is bound to a named authoriser, target estate, and testing window — a signed authorisation-to-test and rules of engagement (extends KYE Purpose Permission™). No recorded engagement authority, no action.
- 2 — Exploit Scope Gate & Credential Test Authority. The Action Admissibility™ gate verifies the target is inside the authorised scope and clears the production-impact exclusion before an exploit fires; a credential test is admitted only under recorded delegated authority.
- 3 — AI Pentest Agent Gate. An autonomous AI pentest agent is a first-class principal with an in-force authority binding — its offensive action is admitted only against a live authorised scope. Production-impacting actions stay advisory until two-person sign-off; unreviewed actions are refused and routed dual-channel.
- 4 — Disclosure, Patch Receipt & Evidence Bundle. The runtime emits kye.purpose.request.v1 + kye.purpose.admissibility.v1 + kye.evidence.decision_map.v1 + kye.evidence.pack.v1 in lockstep — a coordinated vulnerability disclosure decision, a patch-authority receipt, and a sealed Evidence Pack™ binding the actor, the scope, the authoriser, and the Authority Finality™ outcome, signed and replay-derivable for an assurance auditor or a regulator spot check.
Bound to the offensive-security authority + scope + provenance perimeter.
The pack binds the canonical KYE™ artefact set to the offensive-security methodology perimeter. Every claim resolves to a control area on the bound methodology — the five standards are consumed by the rule pack as authority-and-scope inputs, never re-mapped as KYE-enforced framework rows.
| Methodology | Control area | Pack coverage |
|---|---|---|
| PTES | Pre-engagement interactions, scope & rules of engagement, production-impact approval, reporting | partial |
| OSSTMM | Engagement scope, rules of engagement, operational security testing rigour | partial |
| NIST SP 800-115 | Rules of engagement, handling & approval, test-record retention | partial |
| OWASP WSTG | Testing scope and authorised-target coverage for web application testing | partial |
| CREST | Authorisation and scoping, evidential-record requirements, professional accountability | partial |
Honest scope. KYE Protocol™ governs the authority, agreed scope, sign-off, and provenance of the offensive action at the action boundary — whether the action may proceed. It does not run the scanner, fire the exploit, execute the pentest, judge whether a finding is a true vulnerability, or replace the tester's methodology or the customer's security program. Partial coverage means the bound surface satisfies the control area when paired with the tester's own methodology and the customer's security program.
Qualified offensive-security partners — apply through the Foundry.
The KYE Offensive Security Authority Pack™ is a §68 sector product productised through the KYE Sector Pack Foundry™ Build tier; commercial distribution is value-based, qualification-gated, and disclosed under NDA to qualified applicants.