Factory is leagues ahead of any other out-of-the-box harness. It’s a product I regularly recommend when consulting and chatting with peers. Seriously, hats off to you all for building a truly differentiated product in an increasingly bloated market segment. I’ll be a happy customer as long as you still have an offering suitable for the little guys.
This looks like a genuinely fun exercise in security. What size/category of businesses are you primarily looking to bring into wargames? Can you share more about what a typical simulated attack/report/fix cycle looks like and how long you anticipate a partnership to last?
I think our options are pretty open, to be honest. The attack cycle would look a lot like a very, very aggressive pentest: we'd team up to write a statement of work, then run the test. Afterward, we'd give you the detailed findings. Finally, we'd work with you to get Droid to find the root causes and fix them. Length? I think "as long as it takes", but I think we'd be looking at days or a very small number of weeks. The key part is that it really is a partnership. We're making some new tooling and want to validate our processes with someone who wants to work closely with us.
You can email me at kirk@factory.com if you have questions you'd rather ask privately.
If I say that Joe Schmoe, CTO of Widgets, Inc., and I want you to test widgets.com and show me all the vulnerabilities, how sure are you that I'm actually with that company? Even if I actually work for the company, how sure are you that I'm not actually a rogue employee who's going quit the moment I get the report?