zaaf
/zaːf/noun, Turkish
A weakness; a point where something gives way.
We named the company after what we look for.
Every system has one. Our work is to find it before someone else does, prove it with evidence and explain how to close it. The name keeps us honest about the job.
About Zaaf
AI can investigate. Accountability stays with us.
Zaaf grew out of its team's own security research. Agents do the tireless part; a review desk of human researchers reproduces, judges and signs every finding.
-
0105Nazar
The look you do not see coming.
In Turkish it is called nazar. When something fine breaks for no clear reason, people say nazar değdi: the evil eye touched it. For centuries the answer was not to hide, but to look back: a blue bead above a doorway, an eye woven into a kilim.
nazar
/naˈzar/noun, Turkish
The evil eye: a look, envious or admiring, that is believed to harm what it falls on.
idiomnazar değmek to be touched by the evil eye
-
0205Steps
An eye against the eye.
Anatolian weavers wove an eye of their own into the cloth, row by row. On a loom a diagonal can only climb thread by thread; that is where the steps of the tamga come from. The Eye tamga is found from AD 550 to 750 and is recorded as the Köz tamga in the Defter-i Cengiz-nâme.
-
0305Square module
From thread to pixel.
A screen keeps the loom's rule. Threads become pixels, pixels become modules, and the eye keeps its shape: five by five modules, stepped in four directions.
-
0405Plus space
Divided in four, it turns the look away.
Dividing the eye in four with a plus turns the evil eye away, in every direction at once. The plus at the centre of our emblem is that division. It always stays empty.
Turned away, in four directions.
-
0505Our emblem
That is why our logo is an eye.
A system is rarely harmed by the threat everyone is watching. It is harmed by the one nobody sees coming. Zaaf's emblem is the Eye tamga, an eye that looks first: Zaaf likewise protects systems against threats that go unnoticed.
- StepsA body stepped in four directions.
- Plus spaceThe eye divided in four. It always stays empty.
- Square moduleFive by five modules, like the grid of a loom and the pixels of a screen.
On record
- Emblem
- Eye tamga, 5 × 5 modules
- Recorded
- Defter-i Cengiz-nâme
- From
- AD 550 to 750
Research first. A service second.
A finding that cannot be reproduced does not make it into a Zaaf report.
Zaaf began with our own security research. We built a research harness for ourselves: agents that could follow how an application, its APIs and its cloud connect, log what looked wrong and keep the evidence.
The agents were tireless, and they were also wrong often enough to matter. So every observation went to a person before it went anywhere else. That habit became the review desk, and the review desk became the product.
Today the harness runs as Countermind: AI-led, human-verified security work for web applications, APIs, cloud infrastructure and Web3 contracts. We work business to business, with the founders, engineering and security teams of SaaS, fintech, Web3 and other software companies.
How we got here.
Illustrative timeline.
- Research Our own security research The team works on web, cloud and Web3 security, one finding at a time.
- Harness A research harness Agents follow how systems connect and keep the evidence. A person checks every observation.
- Review desk The review desk Checking becomes a role: reproduce, judge, sign. Unreproduced suspicions stop at the desk.
- 2026 Countermind The harness and the desk become a service for web applications, APIs, cloud and Web3.
- Oct 2026 Zaaf identity The Eye tamga, the plus space and the slogan: Confidence loves a challenge.
- Next Physical devices In development. Not yet offered as a service.
In numbers.
The last two figures come from an illustrative sample engagement.
- named researcher signs each findingReview desk
- 1
- unreproduced findings reportedReview desk
- 0
- surfaces: Web & API, Cloud, Web32026
- 3
- observations in a sample engagement2026
- 486
- of them became verified findings2026
- 15
Confidence loves a challenge.
Confidence is not afraid of being tested. A team that is sure of its system invites the question; a finding that survives the question is worth acting on.
What we hold to.
Six commitments that shape every Countermind, from the first call to the retest.
-
Principle 01
Proof, not alerts.
A suspicion is where the work starts, not what we deliver. Every finding arrives with a request, a response and the conditions needed to see it again.
-
Principle 02
A person signs every finding.
Agents investigate. A named researcher reproduces the finding, judges its impact and signs it before it reaches your report.
-
Principle 03
A scope, not a licence to roam.
Systems, accounts, actions and limits are written down and agreed. Nothing runs before you say so.
-
Principle 04
Say what was not tested.
Open questions and testing limits stay in the report by name. A gap is never presented as a clean result.
-
Principle 05
Calm, exact, evidence-based.
We do not frighten, exaggerate or promise that a system is secure. We say what we saw, how sure we are and what to change.
-
Principle 06
A fix is closed by a retest.
Where a retest is agreed, it checks the same finding against the same target, after the fix, and the result is signed like the finding was.
The review desk.
The review desk is the group of researchers between the agents and your report. Nothing reaches you without passing it.
-
01AI-supported
Agents
Explore within the written scope, log unusual behaviour and collect requests, responses and context.
-
02Review desk
Researcher
Reproduces each observation with the agreed test accounts, rules out noise and judges the real impact.
-
03Review desk
Sign-off
Approves the wording, the severity and the fix, and signs the finding with a name.
Every observation leaves the desk in one of five states.
- Supported finding The evidence supports a specific mechanism and an observed result.
- Open question The observations do not establish the conclusion. The uncertainty is named.
- Testing limitation Access or environment prevented a check. The gap is named.
- Simulated condition A controlled test used constructed conditions. The boundaries are stated.
- Not reproduced It could not be seen again. It does not enter the report.
One finding, two days at the desk.
Illustrative day. Anonymised, not customer data.
How a single observation became ZF-0147-02 in the first two days after kickoff, from the first flag to a signed finding.
-
Who: Agent
State: Open question
An observation is logged
One merchant's key returns a 200 for a settlements path that belongs to another merchant. The agent logs it with the request and response.
-
Who: Agent
State: Open question
Context is collected
The agent records which roles, endpoints and test accounts were involved, and stops at the edge of the written scope.
-
Who: Researcher
State: Open question
Picked up from the queue
The next morning, a researcher reads the evidence and decides it is worth reproducing. Most observations end here as noise.
-
Who: Researcher
State: Supported finding
Reproduced
Seen again with a second assigned test account, on a fresh session. The behaviour holds.
-
Who: Researcher
State: Supported finding
Impact judged
How far it reaches: 1,284 merchants' settlements and IBANs. Severity Critical, CVSS 9.6, CWE-639.
-
Who: Researcher
State: Supported finding
The fix is written
An ownership check on the merchant ID, and how a retest will confirm it.
-
Who: Researcher
State: Supported finding, signed
Signed
Wording, severity and fix approved. The finding enters the report with the researcher's name.
Over the same two days, 37 other observations were closed as not reproduced. None of them reached the report.
Straight answers
Who are the researchers on the review desk?
Security researchers from Zaaf's own team. The researcher who verifies a finding is named in your report.
Does a person really check every finding?
Yes. Agents investigate and collect evidence; a researcher reproduces each finding, judges its impact and signs it. Anything that cannot be reproduced stays out of the report.
What does the name mean?
Zaaf is the Turkish word for a weakness. We named the company after what we look for.
Who does Zaaf work with?
Companies, not individuals. Zaaf works business to business with SaaS, fintech, Web3 and other software companies, alongside their founders, engineering and security teams. Those are the sectors our clients work in; Zaaf itself is a security company.
Where is Zaaf based?
Zaaf is based in Türkiye and works with teams in any time zone, in English.
How do I start?
Book a 30-minute call or write to hello@zaaf.ai. We agree a written scope before anything is tested.
Bring your scope. Let's plan the Countermind.
A 30-minute call about your systems, priorities and timeline. Nothing runs before you say so.
- Next step
- 30-minute call
- With
- A Zaaf researcher
- You bring
- One scope
- Runs before you agree
- Nothing