Independently tested by Workstreet

Symmatrics KDC emerges from independent black-box security assessment with zero confirmed vulnerabilities.

Independent offensive-security testing by Workstreet found zero Critical, High, Medium, or Low vulnerabilities across the externally reachable attack surface of the Symmatrics Key Distribution Center.

Independently tested

12,654

attack requests

77

security tests

0

Critical vulnerabilities

0

High vulnerabilities

0

Medium vulnerabilities

0

Low vulnerabilities

What Was Tested

77 tests. 12,654 requests. Every major attack class.

Workstreet combined tool-assisted testing with strict manual verification across the full externally reachable surface of the KDC, covering — among others:

Cross-site scripting (XSS)
SQL injection
Server-side SSRF)
XML external entities (XXE)
Code injection
CORS misconfiguration
TLS / certificate configuration
Exposed files
Security headers
+ other attack classes

// Methodology aligned to the OWASP Top 10 (2021). Every candidate signal manually verified.

The Assessment

Black-box. External. Unauthenticated.

Approach

External, unauthenticated black-box assessment of the in-scope host, testing real-world resilience against outside threats.

Standard

Recognized industry methodologies including the OWASP Top 10 (2021).

Verification

Every candidate signal from tooling was manually verified by dedicated testers for accuracy and real-world applicability.

False positive

One reflected-input candidate was investigated and did not reproduce under a context-breaking payload — recorded as a validated false positive, not a finding.

Hardening note

A single informational observation: no security.txt published at the expected path. Recommended as a minor hardening step.

Conducted for

Symmatrics

Conducted by

Workstreet

Initial report

Sep 12, 2026

Risk posture

Informational

No confirmed weaknesses across the external surface.

Why It Matters

As AI accelerates attacks and organizations prepare for the post-quantum era, Symmatrics is building a fundamentally different security architecture around continuously delivered, single-use symmetric keys. In independent penetration testing, nationally leading testers identified no vulnerabilities within the assessed environment.

Full report available upon request. Press release forthcoming in the PR library.