- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Aquila I Continuous Automated Red Teaming (CART)
Your last penetration test came back clean. Three changes later, nobody has tested again — Aquila I CART keeps emulating real attackers across your external and internal estate — discovering exposed assets, chaining weaknesses into breach paths and proving which ones can really be exploited.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Aquila I platform family
This page covers Aquila I Continuous Automated Red Teaming (CART) — exploit-path validation from the outside in. The rest of the platform:
Quick facts
30-second orientation- Product
- Continuous automated red teaming: outside-in discovery, attack-path chaining and safe exploit validation
- Maker
- Aquila I Solutions Pvt. Ltd., Thane (Mumbai Metropolitan Region); founded 2020; no outside funding reported (Tracxn)
- Platform
- The validation layer of Aquila I’s platform beside BAS; findings feed its detection engineering
- Price
- Quote-only; no published price, no INR list and no public licence meter
- Scope
- External and internal environments, across identity, infrastructure, cloud and application layers
- Deployment
- Cloud-native SaaS by Aquila I’s account; how internal tests reach your network is not documented
- Customers
- Aquila I publishes no named customer case studies; the CART datasheet dates from October 2025
- Analysts
- No analyst placement for Aquila I or for CART; no third-party evaluation has been published
- India
- Indian-built, but the SaaS hosting region is not published; India origin is not data residency
- In India via
- TechBag — scoping, the hosting region in writing, a quote in INR with GST, pilot support
Understand continuous automated red teaming before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is continuous automated red teaming?
It keeps emulating real attackers against your estate and proves which paths could actually be exploited.
A yearly pentest and a scanner export vs Aquila I CART — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A yearly pentest and a scanner export | Aquila I Continuous Automated Red Teaming (CART) |
|---|---|---|
| Testing cadence | One penetration test a year | Adversary emulation that runs continuously |
| New exposures | Found at the next engagement | Tested soon after they appear |
| Findings | A long list of scanner issues | Chained breach paths, ranked by feasibility |
| Proof | Assumed from a CVSS score | Exploit feasibility checked by safe execution |
| Defender feedback | A report handed over at the end | Activity correlated with detection telemetry |
| What it is NOT | — | A human red team, a VAPT report or a published price |
The cheapest test is your external edge: run CART for a month and compare its proven paths with the findings of your last penetration test.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Recon
CART keeps discovering exposed domains, services, APIs and shadow infrastructure, then enumerates misconfigurations and weak authentication paths across them.
Attack
Simulated attacks progress from a foothold through privilege escalation and lateral movement to impact, across identity, infrastructure, cloud and application layers.
Validation
Aquila I says exploit feasibility is validated by controlled, safe execution in production; the safety controls and the internal footprint are not documented.
Telemetry
Red-team activity is correlated with telemetry to judge detection and response, and Aquila I says detection engineering agents use CART findings to tune rules.
Reconnaissance, attack chains and controlled exploits across your estate — findings ranked and fed back to the defenders.
Nine capabilities. Discover, exploit, prioritise.
Aquila I CART tests your estate the way an attacker would — continuously, from the outside in, with proof of what is exploitable.
Continuous external mapping
Maps exposed domains, services, APIs, misconfigurations and shadow infrastructure across the external footprint as it changes.
Autonomous reconnaissance
Enumerates exposed services, weak authentication paths and exploitable assets continuously, the way an attacker scouts first.
Cloud and application flaws
Tests multi-cloud and hybrid misconfigurations, plus application weaknesses such as injection and authentication bypass.
Controlled exploit validation
Confirms whether a weakness can really be exploited through controlled attack execution in production, per Aquila I.
Credential and privilege abuse
Simulates credential abuse and privilege-escalation scenarios across hybrid environments, where most breaches widen.
Lateral movement and blast radius
Models post-compromise movement to test segmentation, containment and blast-radius controls, from foothold to impact.
Chained breach paths
Links weaknesses across systems into breach paths, so findings arrive as routes to impact rather than disconnected issues.
Ranked by exploit feasibility
Prioritises findings by exploit feasibility, privilege relationships and potential business impact, per Aquila I’s page.
Executive and technical reports
Dashboards track exploit success rates, attack-surface reduction and remediation over time, for the board and the engineers.
Attackers do not wait for your annual pentest. Aquila I CART does not wait either.
Here’s what genuinely sets it apart — and exactly where it stops.
Red teaming that does not stop
A yearly penetration test is a snapshot, and the estate changes the week after. Aquila I CART runs adversary emulation continuously across external and internal environments, so a newly exposed service, a weakened login path or a cloud misconfiguration is tested when it appears rather than at next year’s engagement.
Findings that arrive as attack paths
Scanners list thousands of vulnerabilities, and few are reachable. CART chains weaknesses across systems into breach paths, validates exploit feasibility by controlled execution, and ranks findings by privilege relationships and business impact, so remediation goes first to what would actually let an attacker in.
Feeds the defenders as well
Aquila I correlates CART activity with telemetry to judge whether detection and response worked, and says its detection engineering agents use CART findings to propose new rules and retire degraded ones. That loop is strongest if you also run Aquila I AI SOC; on another SIEM, ask what reaches it.
Where it stops
It finds and proves exploitable paths; it does not test every control rule as BAS does, and it is not a human red team or a CERT-In-empanelled audit. How it tests inside your network is not documented. Pricing is quote-only, the hosting region is not published, and Aquila I names no CART customers.
The numbers behind the platform
What your Aquila I CART rollout looks like
Set the scope and the rules
List the domains, IP ranges, cloud accounts and internal segments in scope, and agree what CART may and may not touch.
Settle hosting and access
Get the hosting region and the way CART reaches internal networks in writing, then record both in your DPDP and risk registers.
Start on the external edge
Run continuous discovery and exploit validation on the internet edge first, with the SOC told the testing window in advance.
Work the top paths
Fix the highest-ranked breach paths with each owner, then confirm CART can no longer chain through them on the next run.
Extend inside and decide
Add internal segments if the pilot held up, compare findings with your last pentest, and decide whether BAS belongs beside it.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“It found a forgotten staging server with default credentials and showed the path from it to a file share. Fixed in a day.”
“Our annual pentest was clean in March; CART flagged a newly exposed remote-desktop service in June. That changed the budget.”
“Findings come ranked by exploitability, so the team works ten real paths instead of a 400-line scanner export.”
“We still commission an empanelled VAPT for the regulator; CART is what we run in between the audits, not instead.”
“Setting up internal testing took longer than expected, and the documentation on what runs inside our network was thin.”
“Good results, but the hosting region and the licence basis both took several emails to pin down before legal would sign.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the continuous automated red teaming market — tap any vendor to see why it sits where it does.
TechBag Continuous Red Teaming Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; young Indian vendor, no named customers.
Testing Reach × Proof Depth
The grid nobody publishes — how much of your estate a product can test (external, internal, cloud) vs how far it goes to prove a finding: exploitation, chaining and evidence.
External and internal claimed; inside route and safety detail undocumented.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Aquila I CART vs the continuous red teaming field
Against Pentera, Horizon3.ai NodeZero, FireCompass, CyCognito and Hadrian — on deployment, external and internal reach, exploit proof, identity, cloud, apps, detection, price, India data and exit.
| Dimension | Aquila I Continuous Automated Red Teaming (CART) | Pentera | Horizon3.ai NodeZero | FireCompass | CyCognito | Hadrian |
|---|---|---|---|---|---|---|
| What it is | Continuous red teaming | Automated pentesting | Autonomous pentesting | India-founded CART | ASM plus AI pentesting | Agentic offensive tests |
| Deployment | SaaS; inside unclear | Agentless, per Pentera | Docker host or cloud | SaaS, agentless | Agentless, seedless | SaaS, external-first |
| External discovery | Continuous mapping | Pentera Surface | External pentests | Shadow assets, leaks | Seedless discovery | Atlas |
| Internal network testing | Claimed, undocumented | Pentera Core | Its core strength | Network pentesting | External only | Not its focus |
| Exploit validation | Controlled execution | Safe-by-design | Real exploitation | Runs the exploit | Payload-level tests | Agents chain flaws |
| Identity and privilege | Credential abuse tests | Core and Cloud identity | Password audits too | Credential reuse | Not documented | App-level auth |
| Cloud | Misconfig testing | Pentera Cloud | Cloud and Kubernetes | Cloud assets in scope | Exposed cloud assets | External cloud assets |
| Web and app testing | Injection, auth bypass | Surface web apps | Network-led | OWASP Top 10: 2025 | External web assets | Nova for apps, APIs |
| Detection validation | Telemetry loop | Check in your SIEM | Not the headline | Endpoint evaluation | Not documented | Not documented |
| Pricing model | Quote only | Quote only | Tiered, quoted | Per application | Quote only | Per test or platform |
| Published entry price | Not published | Not published | ~$18,600/yr reported | $450–2,500 per app | Not published | From €1,250 per test |
| India data region | Not published | Not documented | Internal host is local | India office, no region | Not documented | Not documented |
| Lock-in and exit | Findings in lakehouse | Agentless exit | Remove one host | Nothing installed | Nothing installed | Per-test exit |
| Best fit | Indian buyer, one vendor | Inside and outside proof | Internal network depth | Apps and edge, from India | Unknown external assets | External edge, per test |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Aquila I Continuous Automated Red Teaming (CART) if…
- ✓You want exploitable paths found and proved continuously, not once a year at the annual penetration test
- ✓You prefer an Indian vendor and may also buy its BAS, attack surface monitoring or AI SOC products
- ✓You want red-team findings correlated with detection telemetry, so the SOC learns from every run
Compare alternatives if…
- ✓You need a price to start from — FireCompass lists per-app pentest prices and Hadrian Nova starts from €1,250 a test
- ✓Internal network depth is the priority — NodeZero runs from a host inside your network, Pentera Core from within
- ✓Unknown internet-facing assets are the bigger worry — CyCognito leads with seedless external discovery
Do not expect…
- ✓A report a regulator accepts in place of a VAPT: it is not a CERT-In-empanelled audit or a human red team
- ✓Public documentation of how internal testing reaches your network, or a published hosting region
- ✓Rule-by-rule validation of your EDR, gateways and DLP — that is what BAS is for
TechBag has no continuous automated red teaming guide yet, so Aquila I Continuous Automated Red Teaming (CART) sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What does chasing unproven findings cost you?
Drag the sliders (assets in scope; engineer-hour cost). Estimates model the engineering time spent preparing periodic pentests, triaging scanner findings nobody has proved exploitable and re-testing fixes, at an assumed 1.5 hours per asset a year, with 70% of it removed by continuous, validated attack-path findings. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Aquila I publishes no price for CART or any other product, no INR list and no licence meter, so it is not clear whether a quote counts assets, IPs, domains or engagements, or how often testing runs. How internal testing reaches your network is not documented either, and it affects cost. TechBag maps the scope first, then gets the quote itemised in INR with GST.
Aquila I CART
Best for proving exploitable paths continuously
- Quoted per estate; no public meter
- External and internal scope claimed
- Findings ranked by exploit feasibility
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Aquila I CART with BAS
Best for testing exposures and controls together
- Two products, each quoted
- Outside-in plus inside-out validation
- Both feed the same lakehouse
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
How does CART test inside the network — an agent, an appliance, a VPN or a jump host — and who maintains it?
Where does Aquila I host the SaaS and store attack-path findings? Get the region in writing for DPDP Act records.
What stops an exploit attempt from disrupting production — safe payloads, rate limits, a kill switch — and who approves runs?
How are scope limits enforced, so CART never touches a third party’s asset, a partner network or an excluded system?
What does continuous mean in practice — daily, weekly or on change — for external testing and for internal testing?
What does the quote count — assets, IPs, domains or engagements — for what term, and is it shown in INR with GST?
Does each finding carry proof of exploitation and steps to reproduce, in a format your auditors and engineers accept?
Will CART findings satisfy your auditor, or do RBI, SEBI or IRDAI rules still require a separate empanelled VAPT?
Questions buyers ask
Ready to evaluate Aquila I CART?
Map the domains, IP ranges and segments in scope first, or let a TechBag advisor get Aquila I’s hosting region and internal-access method in writing, with the quote in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.