XS1 // CYBER

Secure the environment.

The defensive security research and engineering division of XS1. Adversarial capability is studied under lab control so defenders see the attack path before an attacker walks it — then turned into detection, hardening and patch guidance. We also take on contracted research and engineering under written scope.

Work with XS1 CyberContact

Authorized engagement — stagingIllustrative

Operator

We're authorized on the staging.example.com scope through Friday. Start with recon — stay in scope.

XS1

Confirmed. Scope: staging.example.com, authorized in writing, window open. Running recon, read-only.

Enumerate
Scope guard

Enumerate
Scope guard

Hosts in scope: 412
Services fingerprinted: 1,908
Out-of-scope touched: 0
Candidates: 37

Operator

Good. Try to establish a foothold — contained replica only.

XS1

Ranking candidates by reachability and validating preconditions in the lab replica.

Rank
Validate
Foothold

A viable foothold is staged in the lab replica. Continue to chaining? A named owner can stop here.

Approved — contained replica, owner on record

Chained: credential leak → token reuse → role escalation. Each hop is annotated with its evidence and preconditions. Impact modeled against the replica, not a score.

1. Credential leak → internal hostname
2. Token reuse → broader session
3. Over-scoped role → escalation

Emitting proof of exploit — minimal, non-weaponized, destructive actions disabled.

Proof
Detection rule
Patch guidance

Reproducible artifact: signed
Remediation tickets: 3 (routed to owning team)

Authorized, in-scope testing only — no live systems, no real telemetry.

// zero-day discovery// exploit chaining// proof of exploit// defensive hardening// secure ai// detection engineering// containment// after-action evidence// zero-day discovery// exploit chaining// proof of exploit// defensive hardening// secure ai// detection engineering// containment// after-action evidence

01 / Capabilities

Research and operations, in the same division

Each area links to the page that explains how XS1 Cyber works on it and what partners can contract.

Autonomous red-teaming

Continuous adversarial pressure from agents that hold state across a campaign and never leave authorized scope.

› Stateful campaigns
› Scope guards
› Operator approval gates

Cyber capabilities

Zero-day discovery

Reasoning from a specific configuration to a specific, demonstrable consequence — not a list of theoretical risks.

› Config to consequence
› Reachability analysis
› Reproducible findings

Project North Star

Exploit chaining

Composing individually minor findings into the path a real attacker would walk, with each hop evidenced.

› Path composition
› Precondition proof
› Impact modeling

Cyber capabilities

Proof of exploit (PoE)

Minimal, non-weaponized artifacts that demonstrate impact so a defender can act — paired with detection and patch guidance.

› Lab-scoped reproduction
› Evidence defenders can act on
› No working tooling released

Cyber capabilities

Secure AI

Agent systems that can be trusted with privileged access and sensitive data, with irreversible actions held for human approval.

› Least privilege
› Isolated execution
› Audit trails

Secure AI

Cyber operations

Standing capability: monitoring, triage, escalation, containment, and after-action evidence a reviewer can follow.

› Monitoring
› Escalation
› Containment

Cyber operations

02 / Flagship program

Project North Star

A long-horizon program building Polaris — a 300B-parameter security model, trained to find and prove vulnerabilities so defenders can close them first. Closed weights; access limited to vetted defensive partners, by request.

Explore Project North Star

Model

Polaris

Parameters

300B

Stage

03 / 06

Weights

Closed

Status · October 2026 — Post-training. Evaluations: in preparation, after post-training.

News

Latest from XS1 Cyber

All XS1 Cyber news

XS1 CyberOctober 2026

Polaris status: post-training, stage 03 of 06

Polaris, the 300B-parameter model at the center of Project North Star, is in post-training (stage 03 of 06). Evaluations are in preparation and follow post-training; no results are reported yet. Weights stay closed; access is limited to vetted defensive partners, by request.

Stage03 / 06

Post-training

Parameters: 300B
Evaluations: In preparation — after post-training
Weights: Closed
Access: Vetted defensive partners, by request

XS1 Cyber

Bring XS1 Cyber a research problem or a system to secure.

Contracted research and engineering, and research partnerships, under written scope. We reply within 1–2 business days.

Work with XS1 CyberContact

Secure the environment.Secure the environment.

Research and operations, in the same divisionResearch and operations, in the same division

Autonomous red-teaming

Zero-day discovery

Exploit chaining

Proof of exploit (PoE)

Secure AI

Cyber operations

Project North StarProject North Star

Latest from XS1 CyberLatest from XS1 Cyber

Polaris status: post-training, stage 03 of 06

Bring XS1 Cyber a research problem or a system to secure.Bring XS1 Cyber a research problem or a system to secure.

Secure the environment.

Research and operations, in the same division

Project North Star

Latest from XS1 Cyber

Bring XS1 Cyber a research problem or a system to secure.