Impact With a single API key, the settlements and IBANs of 1,284 merchants could be read.
Evidence
GET /v2/merchants/MRC-58213/settlements HTTP/1.1
Host: api-staging.northwind-pay.example
Authorization: Bearer ██████████████████
Critical
Drag or use the arrow keys to compare.Left: a Countermind finding with severity, class, impact and the request and response that prove it. Right: typical scanner output, a long list of unconfirmed severity flags such as missing headers and possible injections.
Three surfaces. One review desk.
Pick a surface. The page follows.
01 / 03 · Web & API
Test the boundaries your product depends on.
For
Authenticated applications, multi-tenant products and connected workflows.
Start here when
You are changing roles, adding an integration or preparing a sensitive release.
What we discuss
Applications, API operations, relevant roles and designated test accounts.
Transaction-level evidence on a fork or testnet, with the assumption that broke.
What Countermind means
Countermind is the name of Zaaf's AI-led, human-verified security work. It starts with a written scope and ends with evidence, a report and, where agreed, a retest.
A finding that cannot be reproduced does not make it into a Zaaf report.
Start with your question, not a package.
Tell us what is changing. We help you choose a starting scope that answers the decision in front of you.
Surface →Situation01Web & APIApplications, roles and tenant boundaries02CloudResources and service relationships03Web3Contracts, wallets and connected systems
AA product or integration launch
BA permissions or architecture change
CA customer security request
DA remediation cycle
Starting point A1Web & API
A product or integration launch on Web & API
A useful starting scope
The changed workflow and the boundaries it depends on.
What to clarify
Release timeline, test access and the decision the Countermind should support.
What we discuss for Web & API
Applications, API operations, relevant roles and designated test accounts.
Systems, accounts, permitted actions and exclusions are written down.
You + Zaaf
02
Investigate and verify
Agents collect evidence; researchers reproduce it and judge the impact.
AI + review desk
03
Deliver and retest
Findings, limits and fixes are explained; the fix is retested where agreed.
Report + retest
Countermind vs. a traditional pentest
How Countermind compares with a traditional pentest
Aspect
Countermind
Traditional pentest
Who investigates
AI agents across the agreed scope
A tester's time-boxed sample
Who verifies
A named human researcher, every finding
Varies
What you receive
Request, response, impact and fix
Often scanner output plus notes
Noise
Unreproduced suspicions never reach the report
False positives to triage
Retest
Recorded against the same evidence, where agreed
Often extra
Clear about today. Honest about what is next.
Available today
Web & API
Cloud
Web3
Available for scoping today. Listing a surface does not mean every technology inside it is covered.
Next
Physical devicesIn development
Not offered as a service today, and no device work is claimed.
Straight answers
Is Countermind a penetration test?
Countermind is AI-led, human-verified security work. It covers what buyers expect from a pentest, with every finding reproduced and signed by a researcher.
Is the report written by AI?
No. Agents support the investigation; researchers own the technical verification, the impact judgement and approval of everything you receive.
Can one Countermind cover several surfaces?
Yes, where the components and access suit it. Cross-surface coverage is written into the scope, never assumed from the categories.
How do we choose a scope?
Start with the system, the change or concern, and the decision you need to make. We then agree technical fit and the boundaries.
Does a Countermind prove our system is secure?
No. Results are bounded by scope, access, environment and time. Limits and open questions stay visible in the report.
Bring your scope. Let's plan the Countermind.
Thirty minutes with a Zaaf researcher. You bring one scope; we show you what a Countermind would look at first.