"Security operations platform" gets used for three different products. One is a SIEM that stores logs and fires alerts. One is a SOAR that automates the response to those alerts. The third — the one this article is about — is where the actual testing work happens: a console that executes real security tools, keeps the evidence, and turns the evidence into findings. Buyers regularly compare all three, get quoted three different prices, and walk away none the wiser. So let us define it precisely.
The four jobs a usable platform has to do
Strip the marketing away and every serious security operations platform does four things. If one of them is missing, you are looking at a tool, not a platform.
-
Execute. It runs real software —
nmap,nuclei,sqlmap, whichever — with real flags, against a real target, and streams the result back. Not advice about which flags you could use. Not a plausible-looking summary of what a scanner might find. - Orchestrate. It knows that reconnaissance feeds scanning, and scanning feeds exploitation, and it can carry the output of one step into the input of the next without a human copy-pasting between tabs. This is where the "operations" in the name comes from.
- Record. Every command, timestamp, target and result is retained in a form you can hand to a client, an auditor or an incident review six months later. Findings without provenance are opinions.
- Constrain. It refuses to scan its own infrastructure, it enforces who may target what, it isolates one customer's output from another's, and it caps concurrency so that one operator cannot starve the platform. Without this, "automation" means "unsupervised blast radius".
Detection-side versus execution-side
Enterprises mostly buy detection-side platforms: centralise telemetry, detect malicious behaviour, respond. Their unit of value is a saved alert. Offensive teams and consultancies buy execution-side platforms, where the unit of value is a finding — a reproducible statement that a specific weakness exists on a specific system, with proof and a fix.
The two are converging. Detection teams now run continuous attack simulation, and testing teams are asked to prove their work stands up to the same evidence standards as an incident report. If you are choosing a platform, decide first which unit of value you are buying. A beautiful dashboard over no execution is an expensive monitoring toy; a command runner with no record is a liability during an audit.
Hosted or self-hosted?
Historically a testing platform meant a laptop with Kali and a lot of screen real estate. Hosted execution moves the tools to a server and leaves the browser as a terminal. That trade is not free, and anyone selling it as strictly better is oversimplifying.
| Concern | Hosted execution | Local Kali install |
|---|---|---|
| Setup and patching | None — the vendor maintains the toolchain | Yours, per machine, forever |
| Device onboarding | Any browser, including tablets | One machine per licence |
| Layer-2 and RF work | Not possible without local hardware | Native, with the right adapter |
| Latency to target | Whatever the server's network sees | Whatever your network sees |
| Data residency | Vendor-controlled | Fully yours |
| Evidence handling | Central, searchable, exportable | Scattered across machines unless you enforce a process |
The last row is the one people underrate. A consulting team of eight running local Kali produces eight slightly different ways of naming an output file. A hosted platform produces one. That consistency is worth more than the hourly savings, because it is what makes a retest or a dispute survivable.
What a chat wrapper cannot do
Since language models arrived, every interface claims to "run security tools". There is a reliable way to tell the difference, and it is not the marketing page: ask for the command line. A platform that executes prints the command it built, including the target and every flag. A wrapper that generates text cannot, because there is no command.
The second tell is control. Real execution can be paused mid-run and stopped cleanly. Real execution fails in specific, unglamorous ways — DNS timeouts, refused connections, a scanner dying because two flags conflicted. If every run succeeds and every result is tidy, you are reading generated prose.
Point the tool at a host that does not resolve. A real engine returns an error from the operating system — "name or service not known", a transport failure, exit code 1. A fabricated engine returns a finding.
How this maps to JED CO-OP
JED CO-OP sits on the execution side, hosted. The Kali Armory wraps 38 real tools with per-user isolation and a streamed console; the autonomous agent plans across those tools and reports what it ran; the pentest console turns evidence into CVSS- and PTES-mapped findings; and the forensics lab handles disk images with a write-blocker policy. Every action is written to an audit trail, and every scan is bounded by a concurrency limit that depends on your plan.
What it deliberately does not do: raw Wi-Fi capture, layer-2 attacks that need a local adapter, or anything requiring hardware physically attached to a target. Those need a laptop and a radio, and pretending otherwise would be exactly the kind of dishonesty this article is warning you about.
A short buying checklist
- Does it print the command? If not, nothing else matters.
- Can you stop a running scan? Ask them to kill one while you watch.
- What happens on a duplicate run? A platform should deduplicate or warn; a loop is a bug.
- How is output partitioned? Ask what stops user A reading user B's scan output. "We're careful" is not an answer; a filesystem path per user is.
- Does it refuse to scan itself? A platform without a self-scan guard eventually gets pointed at its own API.
- Can you export everything? Findings, raw tool output and timestamps, in a format that outlives the vendor.
Those six questions take an afternoon and will disqualify most of the market. The ones that survive are the ones worth a trial.
Want to try the real thing?
The free sandbox runs a genuine DNS reconnaissance scan on our servers and streams the records back — no account, no install. Signing up unlocks the full Kali Armory and the autonomous agent.