Offline by design
The license never phones home. No callbacks, no analytics, no telemetry to us — your operations are yours, and our business model is licenses, not data.
About
Built by operators who deleted the client.
AXIS is a commercial command-and-control platform for lawful, authorized security work. It exists because the teams who built it spent years operating C2s that pinned them to a workstation — and decided the whole product should fit in a browser tab. This page is who we are, what we optimize for, and how we work.
Doctrine
What we optimize for, in order.
Every roadmap argument ends at this list. When two goals fight, the higher one wins — that is why the agent is 225 KB and not 2 MB, and why the panel carries the whole product.
1
Evasion before features
Every code change is weighed against the detection surface it adds. A feature that makes the fleet louder is a defect, however good it looks on a comparison table.
2
Stability before cleverness
An agent crash is lost access, and lost access is the one failure an engagement cannot absorb. BOFs run under a crash guard; updates ship with a recovery path; the boring option wins ties.
3
Backward compatibility
Old agents work with new servers, and new servers keep talking to old agents. A fleet is an asset; forcing a rebuild to upgrade is a tax we refuse to charge.
4
Novel techniques, not reruns
Ghost Stream, Phantom Gate, Ghost Chain, the module depot — the named pieces exist because the standard answer was not good enough. Where the standard answer is good enough, we ship it quietly and spend the novelty budget elsewhere.
Research
Research-driven, and public about method.
The roadmap is shaped by continuous work against current defensive technology — not by feature checklists. Two programs run permanently: an EDR telemetry study that maps how modern detection stacks actually see, and a signed-driver research program whose candidate pipeline feeds the platform's kernel-side capabilities.
/01
Telemetry studies
How user-mode hooks, kernel callbacks, ETW, and AMSI compose into a correlation engine — and where the blind spots live. Published at category level.
/02Driver research
A private corpus of signed drivers, harvested and rated on a continuous pipeline. The methodology is public; the corpus is licensed material.
/03Research notes
Everything we publish lands on the blog — written to be useful to defenders too, because a detector that understands the implant is a better detector.
We publish methods, not recipes. IoCs, IOCTLs, driver names, and working code stay in the licensed material — that boundary is deliberate and it does not move.
The team
Small, senior, and reachable.
AXIS is built by a compact team of engineers and red-team operators. Several of us spent years on the operator side of the tools you compare us against; the rest come from systems and platform engineering. The size is a decision: every person here can read the whole codebase, and support mail is answered by the people who wrote the thing you are asking about.
Engineering
Platform & agents
Agent core in C, the Go agent, the builder toolchain, per-customer polymorphism, and the release train that ships every quarter without breaking old agents.
Research
Detection & tradecraft
The telemetry and driver programs, plus the unglamorous continuous work: re-testing every named technique against the current versions of the products that claim to stop it.
Operations
Licensing & support
Evaluation vetting, license terms, renewals, and the support mailbox. Same people, same thread, start to finish — no hand-offs between departments that do not talk to each other.
Field work
Operators-in-residence
Active red-teamers who use AXIS on real engagements and bring back the complaints. Most roadmap items start as a sentence that begins “why does the panel make me…”.
Principles
How we sell, and to whom.
AXIS is licensed for lawful, authorized security assessments — red team engagements, adversary simulation, and penetration testing under contract. Every sale is vetted, every license is named, and we decline sales we cannot stand behind. The details are on the legal page and they are enforced, not decorative.
/01
/02
One license, whole platform
Teamserver, panel, both agents, every module, desktop client, toolchain, and every release in the term. No per-feature tiers, no module store.
/03
Honest marketing
This site states scope and limits, and says “licensed material” where it cannot go further. If a claim here cannot survive your evaluation, we would rather not make it.
The sentence on the wall
If a capability cannot be reached from a browser tab, it does not ship.
The doctrine every decision on this site answers to — from the 225 KB agent to the offline license.
Talk to us
Evaluations, press, research — one address.
Qualified teams can request an evaluation license. Researchers who believe they have found an issue in AXIS itself are welcome at the same address and will get an engineer, not an autoresponder.