OpenAI's Aardvark AI security tool operates inside code repositories — what we can call Loop 1, or the Defender Loop. It analyzes code for vulnerabilities, misconfigurations, and security issues before deployment. This is valuable, and represents a genuine advance in developer-side security tooling.
But code-level analysis has a fundamental limitation: deployed environments expose things that code alone cannot capture.
Consider what happens after code is deployed:
Services get misrouted or exposed through infrastructure changes
Cloud configurations drift from their intended state
Authentication flaws emerge from how services interact at runtime
Shadow IT creates assets that never went through any code review process
These are Loop 2 problems — the Attacker Loop. An attacker doesn't read your code. They probe your deployed environment from the outside, looking for what is actually reachable and exploitable right now.
Loop 2 requires external scanning and Continuous Threat Exposure Management (CTEM). You need to see your environment the way an attacker sees it: from the outside, continuously, with validation of what is actually exploitable.
The two loops must connect. Code-level security (Loop 1) and deployed environment security (Loop 2) are complementary, not substitutes. A complete security posture requires both: preventing vulnerabilities from being introduced in code, and continuously validating that your deployed environment does not expose exploitable weaknesses.
ULTRA RED operates in Loop 2 — continuously scanning the external attack surface, validating exposures with proof-of-exploit evidence, and providing the attacker's-eye view that code analysis tools cannot provide.
