// response
Threat Stop_
Finding a problem is only half the job. Threat Stop is the part where the attack actually ends: safely, reversibly, and with a written record of every step.
$ hackex explain --lifecycle
proposed→
approved→
executing→
done
| auto-rollback in 24h (72h for repeat offenders)
THINKS FIRST
- ▸HackEx doesn't fire blindly. It weighs the severity, how confident the diagnosis is, how often it's seen this before, your project's own history, and the blast radius before acting.
- ▸A built-in AI analyst reads every incident and returns a verdict: act, escalate or wait. A confident "wait" vetoes a passing score; a confident "act" can carry a denied one on severe incidents.
- ▸Findings are cross-checked against CISA's list of vulnerabilities being exploited right now, so a real-world attack counts as extra evidence.
- ▸Three autonomy modes: manual approves each action, smart weighs evidence plus your toggles or a plain-English rule like "only restart, never block", and full bypass runs every whitelisted action instantly.
- ▸Your servers stay yours. Actions only ever reach infrastructure you've proven you own, and every one can be undone.
ALWAYS REVERSIBLE
- ▸Blocks expire on their own. A false alarm heals itself in 24 hours.
- ▸An attacker who comes back gets a longer 72-hour block automatically.
- ▸Undo anything with one click from the incident timeline.
FULLY LOGGED
- ▸Every action is recorded: who asked, who approved, what ran, what happened, and why the decision engine allowed it.
- ▸Full bypass skips approvals but never the record: every autonomous run is audit-logged, credit-metered and announced to your channels within seconds.
- ▸Practice runs (fire drills) prove the whole pipeline works before you need it.
// how actions reach your servers
Three ways HackEx can act for you
agent [recommended]
A tiny program you install with one command. It checks in every minute and carries out approved fixes, and works even behind strict firewalls, and we never hold your passwords.
secure shell (ssh)
A direct, encrypted connection used only for the seconds an action takes. Your key stays encrypted at rest and no session stays open.
webhook
A signed message to your own systems: Cloudflare, your firewall, anything that can receive it. Your infrastructure decides what to do.