A clear setup checklist
One checklist of exactly what Kamal’s team needed to do, so they could work through it quickly.
Case studyKamal.ai
Staying ahead of AI-powered attackers.
Kamal.ai brings recruitment agencies’ data together with AI. As AI makes attacks faster and cheaper, Kamal uses AWS Security Agent to probe its own platform first, so its developers keep hardening it with every release.
- Industry
- Recruitment software (SaaS)
- We delivered
- A pen test on AWS Security Agent
Proven
Each finding validated by exploiting it
AWS Security Agent
Staging
A copy of production, never production
In Kamal’s own AWS account
Quarterly
Testing, plus after major releases
Kamal’s plan
The challenge
Security that keeps pace with AI-powered attackers.
Kamal unifies recruitment agencies’ ATS, payroll, timesheet and finance data, with AI insights on Amazon Bedrock. Security is moving fast: AI models now find and chain vulnerabilities in hours, and attackers use them too. Working towards SOC 2 Type 2, Kamal wanted to stay ahead of that, with testing that thinks like an attacker and keeps up with how often it ships. The automated tool it had used before threw up a lot of false positives, so the team spent time on issues that weren’t real.
We’d been using Pentest Tool before, but it threw up a lot of false positives. This one, probably because it has access to the codebase, was able to create more targeted insights, which was quite helpful.
Andrew Worsley
CTO, Kamal.ai
What we built
A code-aware pen test, run end to end.
AWS Security Agent runs inside Kamal’s own AWS account, performs the testing and generates the findings. Assembly set it up on Kamal’s staging environment, ran and monitored it, and walked the team through the report.
What we delivered
Safe access to staging
A staging copy of production, least-privilege access, and the test login kept in AWS Secrets Manager.
A monitored run
Assembly ran the agent and watched it to the maximum run time agreed before it started.
A findings walkthrough
Each finding with a description, steps to reproduce, evidence and a suggested fix, walked through with the developers.
01 / 04
What’s next
Testing on every major release
Kamal plans to run the agent at least once a quarter and after major releases.
Powered by AWS
How the test runs on AWS.
AWS Security Agent works inside Kamal’s own AWS account and VPC: it reads the code, attacks a copy of production and proves every finding before it reports it.
High-level view · how a run works
01
In Kamal’s own account.
AWS Security Agent runs inside Kamal’s AWS account, so the code, test logins and findings never leave it.
02
Reads, then attacks.
AWS Security Agent reads the code and design documents, then runs real attack chains against staging.
03
Staging, not production.
The target is a copy of production in Kamal’s AWS account, with backups, so data changes during a run stay contained.
04
Guardrails first.
Least-privilege AWS IAM, the test login in AWS Secrets Manager, AWS CloudTrail and an agreed maximum run time.
Key results
Stronger with every release.
Signal
Targeted
Findings, not noise
With the codebase in view, the agent produced more targeted insights than the automated tool Kamal used before.
Action
Hardening
Security improved, continuously
Steps to reproduce and suggested fixes go straight into Kamal’s developer workflow, so every run makes the platform harder to attack.
Cadence
Quarterly
And after major releases
Kamal plans to keep testing, with runs started from its release pipeline next.
Our certified expertise
AWS Advanced Tier Services Partner and Well-Architected Partner Program. All 12 current AWS Certifications are held by our team.
