FEINT

Method

What you get.

Every night, a fleet of agents tests your household. Every morning, a person reads what it found. On a schedule you sign, people you have met test your habits.

A man in a work shirt holds a mug and studies an open walnut cabinet of computing hardware in a sunlit workshop.
Tomás Whitfield, fleet engineer. He runs the agents that audit every client, every night.Fictional person

Feint has two halves. The first is the fleet: AI agents that audit your household every night, on private models. The second is a small team of people who read the fleet's work, test what agents cannot, and stand beside you when something real happens.

This page explains both, in the order you would meet them. It is long on purpose. We would rather you knew exactly what will happen.

Everything here happens inside the rules of engagement. Each adult in scope signs their own authorization. We test only systems you own or control. Anyone can say halt, at any moment, and the work stops.

The diagrams below play when you reach them. Each has controls, and each has a plain-text summary. If your device asks for reduced motion, they show their final state.

One night of the fleet

While the house sleeps, the fleet goes to work.

This is a single deep run, from first map to morning report. Press play, or drag through the night.

The fleet runs every night for every client, on private local models. A deep run is the fleet at full depth, with frontier models. It comes monthly or more often, depending on your tier.

The method is adapted from Cloudflare's open security-audit workflow. We changed one thing: the target is a household, not a codebase.

Animated diagram of one deep run. Four agents map 55 coverage units. Hunters cover each unit and raise 37 candidates. Each candidate goes to a fresh agent that tries to disprove it. Most are rejected. Confirmed findings are read by an analyst, and the morning report arrives at 6:00 a.m.
StageReconnaissance

The agent that checks a finding is never the agent that found it.

A hunter's job is to suspect. A verifier's job is to doubt. Keeping them apart is what makes a confirmed finding worth your morning.

Confirmed
A complete trace from cause to effect, and a bounded, observed result.
Needs validation
One exact unresolved fact. It carries no severity until a person settles it.
Rejected
Disproved. It stays on the record, so you can see what was checked.
Read this diagram as text

At 11:00 p.m., four reconnaissance agents map the household into 55 coverage units across eight surfaces. From about 11:50 p.m., hunters work through the units. As they go, 37 candidates surface. From about 3:05 a.m., each candidate goes to a separate, fresh verifier that tries to disprove it. In the run shown, 6 are confirmed, 7 need validation, and 24 are rejected. From 5:00 a.m., an analyst reads each confirmed finding. The morning report arrives at 6:00 a.m.

Source: the 55 coverage units and 37 final records come from one of our own deep audit runs. The surface names, timings, and the split between verdicts are illustrative. Verdict definitions follow Cloudflare's security-audit-skill.

Depth by tier

Every tier runs every day. Higher tiers run deeper.

Compute barely moves the price. What changes between tiers is depth, and the number of people who read the results.

  1. GuardA daily delta: whatever changed, plus a rotating slice of units. A full sweep monthly. Local models.
  2. ParryA full run every night on local models. A monthly Sonnet run, read by an analyst.
  3. RiposteNightly local runs. A monthly deep run on Opus 5.5.
  4. MasterNightly deep runs on local models. Weekly Opus 5.5. A monthly Fable 5.1 run on the hardest surfaces.
  5. The SecondLocal runs twice a day. Daily Opus 5.5. Fable 5.1 twice a week.

Thirty nights

Coverage compounds.

No single night sees everything. So the fleet keeps a ledger, and each night picks up where the last one stopped.

Each night targets the units it has seen least. It also re-checks anything that changed since yesterday: a new device, a new account, an address in a breach list.

A daily run catches drift within 24 hours. Over a month, thin coverage becomes deep coverage.

Heatmap of 55 coverage units over 30 nights. Each night checks about seven of the least-checked units, plus any that changed. Every unit is checked at least once by night 8. By night 30, every unit has been checked at least four times, and each of six household changes was re-checked the night it happened.
Night
30
Checked tonight
0units
Checked at least once
0/55
Checked three times or more
0/55
Changes re-checked that night
0/6
    Read this heatmap as text

    Illustrative schedule for a daily delta run, as at Guard: seven least-checked units each night, plus whatever changed. Higher tiers run full profiles nightly, so their ledger fills faster.

    “In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.”

    That sentence is why Feint runs every night. A yearly assessment is one run. It sees about half of what a patient process would see.

    The fleet carries each night's ledger forward. Nothing is checked from scratch. Nothing is forgotten.

    The morning report

    What lands at six in the morning.

    A folded cream report rests on a linen-covered bedside table beside a cup of black coffee and tortoiseshell glasses, in early light.
    The report, before coffee.Also available on paper

    You never see raw agent output. You see verdicts, in plain language, each with its fix.

    Rejected items stay on the page. You can see what we checked, and why it was fine.

    Most mornings are quiet. A quiet report is still a report. It tells you the fleet looked, and where.

    Open a confirmed item to read its fix.

    FEINT Wednesday, October 21, 2026 · 6:00 a.m.

    Morning report

    The Raman-Castillo household · Riposte

    Illustrative specimen · fictional household
    2Confirmed
    1Needs validation
    6Rejected

    Last night's run covered the whole household. Two surfaces had changed since yesterday: a new laptop in the study, and a router update.

    Confirmed · fix these

    Guest Wi-Fi reaches the router's admin page.Home network · read by an analyst at 5:38 a.m.

    What we found

    A device on the guest network can open the page that controls your router. The admin password is the one printed on the router's label.

    Why it matters

    Anyone you give the guest password to could change your whole network. So could an infected phone a visitor brings in.

    The fix

    1. Open your router's settings from a computer on the main network.
    2. Turn on the setting that keeps guests apart from your network. Many routers call it "guest isolation."
    3. Change the router's admin password. Save the new one in your password manager.
    4. That is all. Tonight, the fleet checks it again on its own.

    About ten minutes. Your lead can walk you through it on a call. Found by one agent, unsuccessfully disproved by a second, then read by a person.

    A plaintext export of the family password manager sits in a Downloads folder.Study laptop · read by an analyst at 5:44 a.m.

    What we found

    A spreadsheet export of the family's saved passwords is in the Downloads folder of the new study laptop. It is not encrypted. It appeared during setup, on Monday.

    Why it matters

    Anyone who opens that laptop, or any backup of it, can read every saved password at once.

    The fix

    1. Delete the export file from Downloads. Then empty the trash.
    2. Check whether Downloads syncs to a cloud drive. If it does, delete the copy there, and empty that trash too.
    3. If it synced, change the passwords that matter most first: email, banking, and the password manager itself.
    4. Next time, export only when you must, and delete the file the same hour.

    About twenty minutes, longer if it synced. Your lead will call at nine to make sure it is gone.

    Needs validation · one question

    The front-door camera may still use its factory password.Smart-home gear · no severity yet

    The open question

    We could not tell whether the password was changed during setup. Finding out ourselves would mean trying to sign in. That was outside last night's scope.

    Next step

    Your lead will ask on today's call. It takes one question.

    Rejected · checked and fine

    • Printer reachable from the internet. Reachable only from inside the home network.
    • Old email address in a 2019 breach list. That password was changed in 2021. The account now uses a passkey.
    • Lookalike of the family domain. Owned by an unrelated bakery since 2014. It sends no mail.
    • A teenager's phone is behind on updates. The update installed at 2:10 a.m., during the run.
    • Shared photo album is public. The link requires an invitation.
    • Router firmware out of date. The vendor's notice covers a different model.

    Found by one agent. Checked by another. Read by a person.

    A day of membership

    Twenty-four hours, accounted for.

    The fleet works while you sleep. A person reads before you wake. Choose a tier to see who reaches out, and when.

    Tier

    A 24-hour day of membership Midnight at the top. The outer ring shows when the fleet runs and when an analyst reviews. A dot at 6:00 a.m. marks the morning report. The inner ring shows hotline hours.

      Times are illustrative. The fleet runs when your household is quiet, and we agree the hours with you.

      A woman with dark curly hair in a linen shirt sits at a wooden table, hands folded, listening intently.
      Inés Navarro, lead operator. Twenty years of testing people's habits, kindly.Fictional person

      The people

      Agents are tireless. Judgment is human.

      The fleet is literal and patient. It never tires, and it never decides what matters. That is the work of a small team you will come to know by name.

      “I look for the gap before someone unkind does. Then we close it, and nobody feels foolish.”Inés Navarro, lead operator. A fictional member of the team.

      1. Penetration testing

        People test what agents miss.

        Agents find single issues. People find chains: a small gap here that opens a large one there. They bring physical context and judgment calls no model makes.

        • Home and office networks, on site or remote.
        • How hard your accounts are to take over: recovery flows, gaps in two-step sign-in, delegated access.
        • Phones, laptops, and travel devices.
        • Checking the fleet's "needs validation" items. Most human hours go here.

        You get a tested, prioritized report, and a re-test after you fix things.

        Riposte: an annual remote assessment. Master: quarterly, including on site. The Second: continuous, with dedicated operators.

        Scope: only systems you own or control. Employer devices and a family office's systems need that organization's own signature.

      2. Exposure monitoring

        What an attacker learns before touching anything.

        Much of a real attempt is research. We do that research first, on you, and remove what we can.

        • Alerts when a household email or phone number appears in a breach.
        • Removal from data brokers and people-search sites, with re-checks.
        • A review of your public footprint: addresses, travel patterns, family details.
        • A watch for lookalikes of your family name and business domains.
        • Mentions on paste sites and the dark web, through a licensed feed.

        You get an "attacker's dossier" on yourself, refreshed quarterly at Riposte and monthly at Master.

        Scope: your household's own names, numbers, and addresses. We do not research third parties for anyone.

      3. Response

        A real incident starts with a phone call.

        Forensics and legal partners are arranged in advance. When something real happens, you call one number, and the right people are already briefed.

        • A hotline: business hours at Riposte, 24 hours at Master and The Second.
        • Tabletop rehearsals. "Your assistant's email is compromised. Walk us through the next hour."
        • Account recovery kits: offline records of recovery codes and contacts, kept by you.
        • Travel preparation: loaner devices, a briefing, and a check of every device when you return.

        You get a plan that already exists before you need it.

      4. Advisory

        A named lead who knows the household.

        Lives change, and so does the threat model. A new home, a new company, a public role, a divorce. Your lead revisits the picture with you as it moves.

        • Threat-model reviews, quarterly or monthly by tier.
        • Purchase and vendor reviews. "Should we install this smart lock?"
        • Board-level reporting for family offices.

        You get one trusted party who holds the whole picture.

      An open waxed-canvas travel pouch on a hotel desk holds a phone, an oxblood passport wallet, and an envelope, beside a leather notebook.
      A travel package: loaner phone, briefing envelope, and a post-trip check.Still life

      Travel

      Travel is when habits slip. Devices cross borders, hotel networks are shared, and assistants act on short notice.

      Before a trip, you get clean devices and a short briefing. After, we check every device that travelled, before it rejoins your home network.

      Who does what

      The fleet prepares. People decide.

      Agents do the patient, repetitive work at volume. People take every decision that touches you.

      The fleetAgents, every night
      The work
      The peopleYour lead and the team
      All of it
      Inventory and drift
      Review what changed
      Reconnaissance, hunting, first verification
      Recurring audit runs
      Confirm, prioritize, explain
      Collection and de-duplication
      Exposure monitoring
      Judge what matters
      Preparation, and listing what you own
      Penetration testing
      Testing, chaining, judgment
      Scheduling, consent tracking, draft reports
      Bouts
      Design, delivery, debrief
      Triage and timeline assembly
      Response
      Decisions, and every call to you

      Agents never contact a person on their own initiative.

      A human designs, approves, and supervises every exercise involving a person.

      Anatomy of a bout

      A rehearsal, by consent.

      A bout tests whether your household follows its own verification habits. The olive-tree passphrase. The call-back number. Two people for any money move.

      We describe a bout here by its structure only. We never publish the content of one.

      Only named, consenting adults are in scope. Minors are never the subject of a bout. Banks, employers, and vendors stay out unless they sign their own authorization.

      Bouts run quarterly at Riposte, monthly at Master, and year-round at The Second, always inside the signed envelope.

      A cream envelope sealed with oxblood wax lies on a walnut desk beside a fountain pen.
      The consent envelope. Each adult signs their own.Still life

      Select a stage to read what happens, who decides, and what "halt" does there.

      “Halt.” Available at every moment, from signature to debrief. One word ends it, with no questions.

      Stage 1 of 6

      Consent signed

      If anyone says “halt” here

      Where your data lives

      Your findings are yours.

      A man in a dark sweater sits in a leather armchair in a book-lined study, a sleeping dog at his feet. A low walnut and steel box with one small light rests on the credenza behind him.
      The private inference box, on a credenza in a client's study.Fictional client

      The nightly fleet runs on a private inference box. It holds open-weight models and talks to no one else's.

      For most members, the box lives in our facility. At Master and The Second, it can live in your own home, on your own network.

      Deep runs use frontier models. When they do, the context that run needs leaves the box for that run. Nightly runs stay on the box.

      Diagram of data custody. Your devices and accounts give read-only access to the box, which runs the nightly fleet on local models. The box sends verdicts to an encrypted findings ledger kept per client. Analysts read confirmed findings and send you the morning report. Deep runs only send context from the box to a frontier model. The box can sit in Feint's facility, or in your home at Master and The Second.
      Guard, Parry, and Riposte.

      Your home

      Your devices and accountsNetwork, phones, laptops, email, cloud, smart-home gear.
      At Master and The Second, the box can sit here.
      YouReading the morning report.

      Feint

      The boxRuns the nightly fleet on private local models.
      The box sits in your home.
      Findings ledgerEncrypted, kept per client. Your property.
      AnalystsRead every confirmed finding. Access logged and reviewed.

      Frontier models

      Opus 5.5 · Fable 5.1Deep runs only, monthly to daily by tier.
      Findings are your property.

      We keep them encrypted and separate for each client.

      Access is read-only.

      You connect read-only access. Agents keep the inventory current. They change nothing.

      Recordings are temporary.

      Bout recordings are deleted after the debrief, unless you ask us to keep them.

      Our own access is logged.

      Staff access is recorded and reviewed.

      We go first.

      Our own team receives this service before any client does.

      We refuse some requests.

      We never point the capability outward, at a spouse, an employee, or anyone who has not signed.

      A fencing mask, an oxblood glove, and a foil rest on a wooden bench in an empty, sunlit fencing hall.

      Membership

      Every tier runs every night.

      The tiers differ in depth, and in how many people know your household by name.

      Membership sets out each tier: what the fleet runs, which people you get, how often you bout, and what you sign. Read it next.

      See membership Read the rules of engagement