About mlab.sh
Security tooling,
built in France.
mlab.sh started as a way to answer one question fast: is this IP, domain, hash or file something to worry about? It grew into a set of platforms covering investigation, attack surface, detection, governance and training, all behind one account.
01
What we believe
i.
Signal over noise
An alert is only useful if someone can act on it. We would rather show three findings that matter than three hundred that do not.
ii.
Evidence, not adjectives
Every verdict comes with what it is based on: the record, the header, the line of code. You should never have to take our word for it.
iii.
Your data is not the product
No tracking, no profiling, no resale. What you search and upload stays tied to your account and serves your investigation only.
Investigate threats, not noise.
02
What we build
- Investigation mlab.sh IOC and file intelligence for IPs, domains, hashes, URLs and files
- Attack surface Redkit Audits of your websites and IP ranges, and of your source code on code.mlab.sh
- Vulnerabilities vuln.mlab.sh CVE intelligence and tracking
- Detection ir, hunt & actors Self-hosted incident response, threat hunting, threat actor database
- Governance tprm & risk Third-party risk management and EBIOS Risk Manager
- Training academy & kids Cybersecurity courses, and cyber education for kids
03
How we work
- Built in France
- Designed, developed and operated by Cyber Dream, a French company.
- Self-hostable
- Incident response and third-party risk can run on your own stack when data must not leave it.
- Open to your tools
- REST API, CLI, MCP server and integrations, so results land where your team already works.
- Shipped in the open
- Every new feature is listed in the changelog, so you can see what moved and when.