Finding your digital vulnerabilities before adversaries do.
Attackers already use AI to search for flaws at scale. Meerkat Watch runs the same kind of search for the owner, with their permission.
The problem
Finding a way into software has become cheap. An AI agent found 21 previously unknown flaws in FFmpeg for about $1,000 of compute, and flaws in WordPress plugins for about $20 each. In our own testing, it costs less than $10 of AI inference to find an exploitable flaw on public websites. Identifying vulnerabilities is becoming cheaper and easier with AI.
Sources: Cloud Security Alliance, 2026; our testing with Meerkat Watch.
Reported · May 2026 · Google Threat Intelligence Group
Attackers are already using AI this way. In May 2026, Google reported criminal groups preparing a mass attack with a flaw they most likely found with AI: a way around two-factor login in a popular web administration tool. Google also saw a North Korean group sending thousands of automated prompts to study known flaws and test working exploits.
The problem
Discovery costs less so attackers check more organizations. Attackers can be target agnostic. They don't care which town or small business they attack, as long as they find an exploitable target.
Our assessment.
Real event · February 2024 · Hamilton, Ontario
In February 2024, a ransomware attack disabled about 80% of the City of Hamilton's network. The city did not pay the $18.5 million ransom. Recovery has cost $18.3 million, and its insurer denied the claim because multi-factor authentication had not been fully set up.
Sources: Global News, 2025; CBC, 2025
How Meerkat Watch works
An organization's public systems go well beyond its website: the plugins behind it, staff login pages, file shares, remote access for contractors, and old test servers nobody remembers.
How Meerkat Watch works
Meerkat Watch uses AI to identify vulnerabilities in your systems the way an attacker would, at the same scale, with written permission from the owner and a scope agreed before any test runs. Testing without that permission is a crime in Canada and the US.
Sources: Criminal Code, s. 342.1; 18 U.S.C. § 1030
How Meerkat Watch works
Automated scanners produce long lists of possible problems. Meerkat Watch reports a flaw only after it has shown that the flaw can be used.
How Meerkat Watch works
The owner gets each finding with the steps to reproduce it. The same steps let them check their mitigation efforts were successful.
How Meerkat Watch works
Systems change: plugins update, staff come and go, new flaws are published. Meerkat Watch changes too. As it improves, it finds flaws it could not find before, so it keeps testing.
How Meerkat Watch works
No test can prove a system is secure, and Meerkat Watch does not claim to. It reports what it finds.
Who it is for
Meerkat Watch works for organizations of any size. It is a cheap way to catch expensive flaws. It covers municipalities, schools, utilities and businesses in Canada and the US. Terms and sign-up are on meerkatwatch.com.