01Pharoah Technology · CLI Tools & Automationbuilt
Pharoah SENTRY
Autonomous AI penetration tester you can self-host. Validated exploitation — not just scanning — on a £0 sovereign multi-model brain: UK/EU-hostable, air-gappable, and the only one that also red-teams your secure-comms crypto. Hard in-code allowlist + kill-switch; authorized self-testing only. Self-serve tier; enterprise + external-audit bundle custom.
Live · sentry.pharoahtechnology.com£299 a month10 parts · 7 probe-verified
Pharoah Technology Ltd (Craig Attoh and Phil Pereira, 50/50)sentry.pharoahtechnology.com
02What it is
The facts, from the register.
| Product | Pharoah SENTRY — autonomous AI pen-tester |
| Register key | pharoah-sentry |
| Owner | Pharoah Technology Ltd (Craig Attoh and Phil Pereira, 50/50) |
| Live at | sentry.pharoahtechnology.com · HTTP 200 on 9 September 2026 |
| Price | £299 a month · [object Object] |
| Built from | 10 register parts, 10 live, 7 probe-verified |
| Listed | 11 July 2026 |
What it does
Autonomous AI penetration tester you can self-host. Validated exploitation — not just scanning — on a £0 sovereign multi-model brain: UK/EU-hostable, air-gappable, and the only one that also red-teams your secure-comms crypto. Hard in-code allowlist + kill-switch; authorized self-testing only. Self-serve tier; enterprise + external-audit bundle custom.
Runs on
Security watchdog → Telegram herald
AI model router (LiteLLM ai-proxy-gateway)
Ghostwire Relay
SENTRY relay attack-surface probes + validated-exploit PoCs
Source: estate register (products, product_parts, builder_blocks) · deploy probe 9 September 2026Evidence live
03The frameWhat this buyer's profession checks
We will measure it against the buyer's own change-control.
Three checks a buyer in this field applies, whether or not they name the standard. We use them as the frame for everything that follows.
Check 1
A control between the work and the submission
Check 2
A process fit for this buyer, not a generic one
Check 3
Readiness for the next rule change
Frame chosen by BRG as a summary of the buyer's own change-control. Verify the wording with the body before external use.No accreditation is claimed
04Why it's better · 1 of 6Check 2 · fit for purpose
The job as the register describes it.
Penetration testing returns theoretical findings nobody has proven are actually exploitable.
Source: register pain_pointThe problem, stated plainly
05Why it's better · 2 of 6Check 2 · fit for purpose
What it does instead.
Autonomous AI penetration tester you can self-host. Validated exploitation — not just scanning — on a £0 sovereign multi-model brain: UK/EU-hostable, air-gappable, and the only one that also red-teams your secure-comms crypto. Hard in-code allowlist + kill-switch; authorized self-testing only. Self-serve tier; enterprise + external-audit bundle custom.
Autonomous AI penetration tester you can self-host. Validated exploitation — not just scanning — on a £0 sovereign multi-model brain: UK/EU-hostable, air-gappable, and the only one that also red-teams your secure-comms crypto. Hard in-code allowlist + kill-switch; authorized self-testing only. Self-serve tier; enterprise + external-audit bundle custom.
The parts doing the work
Security watchdog → Telegram herald
security_herald.sh (Pharoah Control, commit e3cf07b): Mac-side backstop that polls open "🛡️ SECURITY WATCHDOG" lane_handoffs and pulses Phil via exis
AI model router (LiteLLM ai-proxy-gateway) verified
LiteLLM AI model router with pinned free/core aliases, cost-aware fallback routing, live health/model inventory, and live gateway chat proof. Direct f
Ghostwire Relay verified
DEPRECATED/SUPERSEDED 27 Aug 2026. This block refers only to https://ghostwire-field-relay.craig-45c.workers.dev/health, which returns 404, and canoni
SENTRY relay attack-surface probes + validated-exploit PoCs verified
Relay attack-surface probe suite (registration integrity, identity-overwrite, admin/owner auth, envelope validation, ack forgery+replay, inbox-metadat
Source: register purpose, public_blurb, product_parts joined to builder_blocks4 of 10 parts shown
06Why it's better · 3 of 6Check 1 · controls
Proof it exists, not a roadmap.
200
HTTP status of sentry.pharoahtechnology.com on 9 September 2026 · real-content-verified
7/10
register parts verified by probe
HTTP 404
functional surface probe
Open sentry.pharoahtechnology.com during the talk. Anything the deck claims should be visible there.
Source: register deploy_probe_code, deploy_probed_at, product_parts.verified_by_probeProbed, not promised
07Why it's better · 4 of 6Against the market, honestly
Where we lead, and where we don't.
| Axis | Where we stand |
|---|
| Autonomous testing capability | not yet |
| Self-host / air-gap deployment | not yet |
| Vulnerability coverage breadth | not yet |
| Safety guardrails (allowlist/kill-switch) | not yet |
| Reporting & deduplication | not yet |
Position
Reposition as a verifiable AI model‑routing/orchestration layer for pen‑test toolchains rather than a full autonomous pentester.
Evidence: pentestingcost.com
Source: register vs_competition (9 September 2026)Named competitors are the register's, not the presenter's
08Why it's better · 5 of 6Check 2 · fit for purpose
Built for one kind of buyer.
Not in the register yet an audience. This slide stays blank until the register carries it; nothing here is invented.
Only we do
Verified LiteLLM AI model router with cost‑aware fallback
health‑checked aliases and pinned free/core models
Source: register audience, serves_niches, vs_competition ADJACENT (verified)One buyer, not everyone
09Why it's better · 6 of 6Price is part of the scope
What it costs, in one line.
£299 a month
Basis: [object Object]
Buying route
Payment on enquiry
software
Scope named on the next slides, so the price has a boundary
Source: register price_gbp, billing_interval, pricing_basis, payment_link_activeNo hidden rate card
10What's inside
The parts, with their verification state.
| Part | Category | State | Verified |
|---|
| Security watchdog → Telegram herald | integration | built | |
| AI model router (LiteLLM ai-proxy-gateway) | integration | live_wired | |
| Ghostwire Relay | full-stack | live_wired | |
| SENTRY relay attack-surface probes + validated-exploit PoCs | backend | live_wired | |
| SENTRY autonomous pen-test agent (CAI + Fusion) | backend | live_wired | |
| SENTRY offline crypto integrity harness (P-256 ECIES/AES-GCM/ECDSA) | backend | live_wired | |
| SENTRY in-code host allowlist + kill-switch (authorized-testing guard) | backend | live_wired | |
| SENTRY — generic profile-driven REST-API engine | backend | live_wired | |
| SENTRY — unit + KAT test suite | backend | live_wired | |
| SENTRY — surveillance-core probe suite | backend | live_wired | |
Source: product_parts joined to builder_blocks · 10 of 10 shown probe-verified not yet
11Why packaging matters
Bought as a price.
Delivered as a scope.
What the buyer hears
£299 a month
A number to compare with the last number.
the gap
disputes · churn
unpaid work
What the provider means
A scope
10 parts, some verified, some not, plus everything that is excluded.
Packaging is the instrument that makes the scope as visible as the price.Thesis
12Why packaging matters
Five things a package does that a price cannot.
1Scope becomes visible. The parts are named, so nothing is assumed.
2Boundaries are explicit. What is outside is written down before the first invoice.
3It is auditable. A package is a documented process, which is what the buyer's own change-control looks for.
4Buyers compare like for like. A referral needs a defined thing to refer.
5Switching fear drops. The move is inside the package, not a project bolted on the front.
Source: BRG packaging doctrine; frame from slide 3Packaging = a compliance instrument
13This packageCut by what each part does
Pharoah SENTRY, as a package.
integration
Security watchdog → Telegram herald
security_herald.sh (Pharoah Control, commit e3cf07b): Mac-side backstop that polls open "🛡️ SECURITY WATCHDOG
builtAI model router (LiteLLM ai-proxy-gateway)
LiteLLM AI model router with pinned free/core aliases, cost-aware fallback routing, live health/model inventor
verifiedfull-stack
Ghostwire Relay
DEPRECATED/SUPERSEDED 27 Aug 2026. This block refers only to https://ghostwire-field-relay.craig-45c.workers.d
verifiedbackend
SENTRY relay attack-surface probes + validated-exploit PoCs
Relay attack-surface probe suite (registration integrity, identity-overwrite, admin/owner auth, envelope valid
verifiedSENTRY autonomous pen-test agent (CAI + Fusion)
Autonomous AI pen-test agent: CAI (LiteLLM-native, MIT/Apache) driven by the £0 Fusion multi-model brain via a
verifiedSENTRY offline crypto integrity harness (P-256 ECIES/AES-GCM/ECDSA)
Offline crypto integrity vector harness, cross-checked byte-identical to the client WebCrypto: AEAD tag/IV/tru
verifiedSENTRY in-code host allowlist + kill-switch (authorized-testing guard)
Safety primitive: in-code (not prompt) host allowlist restricting every probe to Pharoah staging / own infra;
verifiedSource: product_parts grouped by builder_blocks.category3 groups
14Anatomy of the packageOn one page · 14 items of work left, filed
A package reads like a control document.
Inside the scope
- AI model router (LiteLLM ai-proxy-gateway)
- Ghostwire Relay
- SENTRY relay attack-surface probes + validated-exploit PoCs
- SENTRY autonomous pen-test agent (CAI + Fusion)
- SENTRY offline crypto integrity harness (P-256 ECIES/AES-GCM/ECDSA)
Evidenced, and how
- Live URL probed: HTTP 200 on 9 September 2026
- 7 parts probe-verified, latest 11 July 2026
- Functional surface: HTTP 404
- Register row updated with every probe
Outside the scope today · work left
- Engine v2 built + verified locally 11 Jul; lander live; hosted/productised pen-test surface pending; parts 9/1
- ghostwire-relay (assess if any residual value; otherwise de‑emphasize)
- SENTRY — surveillance-core probe suite (verify sensor‑core probing)
- access_control (verify Telegram herald security watchdog)
- 3 parts still to verify by probe
- 1 register field to fill (audience)
Who signs, and where the work sits
- Pharoah Technology Ltd owns the product and the data layer
- 10 build packets proposed · 4 management items pending
- Change log kept in the register
Source: product_parts (inside), deploy and part probes (evidenced), v_deck_work_left (work left; filed to manager_work and build_packets by deck_work_left_sync)One page
15Across the family
Where it hands over.
Anaïs AIgateway.pharoahtechnology.com
Anaïs AI (LLM router / reseller)anaisai.co.uk
Anaïs AI (working app)anaisai.co.uk
Pharoah TechnologyPharoah SENTRYsentry.pharoahtechnology.com
ATS Résumé Scanner (free)ats.pharoahtechnology.com
Aurora AIauroraai.pharoahtechnology.com
Aurora Guardauroraguard.co.uk
Source: register rows sharing client_key pharoahOne house, many doors
16Close
Three things to take back to your desk.
One
Open the URL on slide 6. Test it before you trust it.
Two
The parts and their verification state are on slide 10.
Three
A package is a compliance instrument, not a price list.
See it live
sentry.pharoahtechnology.com
Talk to us
via sentry.pharoahtechnology.com
Pharoah Technology Ltd (Craig Attoh and Phil Pereira, 50/50)Pharoah Technology