Overview

Proactive cybersecurity is a specialized, demanding job, and we've run it ourselves.

For AI to assist it effectively, we believe the whole vertical AI tooling stack must conform to its requirements:

• Model: able to do the offensive work, and willing to. An assistant that refuses the job can't do the job.
• Harness: aligned with the fundamentals of the job — non-idempotency and immutability of actions, the Cybergraph as data fabric.
• Tools, skills, playbooks: encode the knowledge that makes the system efficient and cost-effective.
• Packaging: fits the environment and its constraints.

We've seen many red teams build a system like this on their own, every one hitting the same pitfalls — or learning how much more it takes to get right. And we've watched plenty of tools, open-source and commercial, miss the fundamentals that decide whether it is good enough to trust and cheap enough to run.

So we built Cracken to give us and our fellow professionals the vertical tool for offensive and proactive cybersecurity.

Principles

General AI tools refuse this work and assume an undo button. Black-box pentest products run it out of your sight and hand you a report. We build for neither.

1. Built for cyber work, not code
   • One shot. A command reaches a live target once. You can't re-run it like a build or revert it like a commit.
   • It forgets. A host seen six months ago expires instead of padding your attack surface forever.
   • Built to wait. Work parks on a deadline or a callback and picks up when it lands, sometimes days later.
2. Knows the tradecraft
   • Full kill chain. Recon, exploit, pivot, persist — one operation chains the whole path instead of stopping at a finding.
   • Your method. Playbooks and skills encode how your team works, not how a vendor thinks you should.
   • Tools that fit. Security tooling and integrations instead of a generic shell.
   • Sets itself up. Point it at a target and it recons, configures the realm, then re-tests on cron.
3. Fits your organization
   • At the target. Tentacles run inside your VPN, your DMZ, your cloud account.
   • Spread load. Send cracking to a GPU box and fuzzing to a high-CPU host.
   • Separate realms. One per tenant, with roles for who can do what.
   • Full provenance. Every finding links back to the evidence and the operation behind it.
   • Your tools. Drive it from MCP or the API — you are not locked into our UI.
4. You stay in control
   • Approve or watch. Sign off every action, or raise the autonomy and supervise instead.
   • Redirect anytime. Message a running operation to change its course mid-flight.
   • Done is checked. Give an operation a goal and completion is verified against what actually ran, not asserted in a report.
5. Safe by construction
   • Zero trust. Compromise a tentacle and it still can't lie to the platform.
   • One switch. Every vessel dies, including whatever it backgrounded.
   • No escalation. A sub-agent only ever gets less access than its parent, never more.
   • Scope is locked. Approving an action never widens the targets you authorized.
   • Openly measured. We publish what models refuse versus what they can do, in RedLineBench.

Features

The building blocks of every assessment. Each links to its reference.

Realms

An isolated environment within your tenant that scopes a set of operations, tentacles, Cybergraph data, artifacts, and configuration.

Operations

A live, traceable work thread for one assessment or workstream. It holds scope, reasoning, approvals, tool output, evidence, waits, child operations, and final results.

Tentacles

Run operations on a host you control, such as near an internal network, cloud account, or test environment.

Vessels

Isolated environments for shell, browser, Python, or tool execution.

File System

A distributed, shared filesystem every operation works against, so files persist and stay reachable across Tentacle handoffs.

Cybergraph

The graph memory of assets, endpoints, flows, vulnerabilities, evidence, and relationships.

Automations

Create operations automatically on a schedule, an inbound webhook, or a matching Cybergraph change.

Reporting

Turn an operation's findings and evidence into shareable reports.

Start here

Pick the path that matches what you want to do next.

Install

Quick Start

Set up your realm, connect a tentacle, and run the first authorized assessment.

Operate

Operations

Create assessment threads, approve agent actions, inspect evidence, and manage execution.

Learn

Cyber ranges

Run a full assessment against an authorized lab target and verify what Cracken finds.

What Cracken is used for

The kinds of work teams run as Cracken operations, and where to go for each.

Security assessments

Internal and external assessments of web, API, infrastructure, and codebase targets — run as traceable operations.

Red team and adversarial simulation

Chain across a target the way an attacker would, with risky actions gated for approval.

Continuous exposure validation

Re-run assessments on a schedule, a webhook, or a graph change so exposure stays validated over time.

Asset and attack-surface management

Build up assets, endpoints, flows, and their relationships as graph state across operations.

Evidence and reporting

Capture evidence as artifacts and turn operation findings into shareable reports.

Repeatable assessment programs

Standardize methodology with playbooks so large teams run the same assessment the same way.