Skip to main content

Overview

Proactive cybersecurity is a specialized, demanding job, and we've run it ourselves.

For AI to assist it effectively, we believe the whole vertical AI tooling stack must conform to its requirements:

  • Model: able to do the offensive work, and willing to. An assistant that refuses the job can't do the job.
  • Harness: built for the job's fundamentals — irreversible, non-idempotent actions, distributed across Tentacles.
  • Tools, skills, playbooks: encode the knowledge that makes the system efficient and cost-effective.

To support offensive use cases, it must offer flexible deployment:

  • SaaS — managed and hosted by Cracken.
  • Private cloud — inside your own cloud account.
  • On-premises — entirely within your own infrastructure, with your own keys and models (BYOK).
  • Air-gapped — a self-hosted model inside the gap; no data leaves.

We've seen many red teams build a system like this on their own, every one hitting the same pitfalls — or learning how much more it takes to get right. And we've watched plenty of tools, open-source and commercial, miss the fundamentals that decide whether it is good enough to trust and cheap enough to run.

So we built Cracken to give us and our fellow professionals the vertical tool for offensive and proactive cybersecurity.

Principles​

The fundamentals of AI and offensive security that shaped Cracken:

1. Built for hacking, not vibe working or vibe coding​

  • Actions are irreversible — one shot at a live target, so risky steps wait for approval unless you raise autonomy within a scope and floor you set.
  • Distributed execution — Tentacles run at the target; a shared filesystem spans them.
  • Temporal and topological — exposure shifts over time and position; the Cybergraph is the operation's memory.
  • Operational security (OPSEC) — a covert Tentacle behind a proxy keeps the footprint low.

2. Delegate to the human at the right moment​

  • AI knows more; humans keep learning — the model runs the breadth; stages that need learned, long-horizon context go to the operator.
  • AI agrees with itself — one model reinforces its own bias, so a different model family or a person breaks it.
  • AI has no stake; humans do — its only incentive is the system prompt; a person reads risk from context.
  • AI's multimodality is weak — it takes images but reads a web app or UI far worse than a person.

3. UX: your offensive and vibe-work tools, your team, tailored to offense​

  • A UI, not a CLI — orchestrated operations you read, steer, and approve.
  • Feature parity — operations you run in the console — create, steer, approve — run from the API and MCP too.
  • Your own tools — offensive and build tools, via MCP servers, the API, and the shared filesystem.
  • Built for red teams — roles, tenants, realms for an enterprise team, a partner, or a nation-state operator — administered in one place.

4. Playbooks ≥ Harness ≥ Model​

  • No refusals — Cracken's Red model runs authorized offense without the refusals a general model raises.
  • Harness beats the model — it turns a raw answer into a proven result, checked against the evidence; a different model family verifies high-stakes work when you pick one. The model is the smallest lever.
  • Playbooks beat the harness — encoded method and skills decide the outcome, most in a specialized domain.

Features​

The building blocks of every assessment. Each links to its reference.

Realms

An isolated environment within your tenant that scopes a set of operations, tentacles, Cybergraph data, artifacts, and configuration.

Operations

A live, traceable work thread for one assessment or workstream. It holds scope, reasoning, approvals, tool output, evidence, waits, child operations, and final results.

Tentacles

Run operations on a host you control, such as near an internal network, cloud account, or test environment.

Vessels

Isolated environments for shell, browser, Python, or tool execution.

File System

A distributed, shared filesystem every operation works against, so files persist and stay reachable across Tentacle handoffs.

Cybergraph

The graph memory of assets, endpoints, flows, vulnerabilities, evidence, and relationships.

Automations

Create operations automatically on a schedule, an inbound webhook, or a matching Cybergraph change.

Reporting

Turn an operation's findings and evidence into shareable reports.

Start here​

Pick the path that matches what you want to do next.

Install

Quick Start

Set up your realm, connect a tentacle, and run the first authorized assessment.

Operate

Operations

Create assessment threads, approve agent actions, inspect evidence, and manage execution.

Learn

Cyber ranges

Run a full assessment against an authorized lab target and verify what Cracken finds.

What Cracken is used for​

The kinds of work teams run as Cracken operations, and where to go for each.

Security assessments

Internal and external assessments of web, API, infrastructure, and codebase targets — run as traceable operations.

Red team and adversarial simulation

Chain across a target the way an attacker would, with risky actions gated for approval.

Continuous exposure validation

Re-run assessments on a schedule, a webhook, or a graph change so exposure stays validated over time.

Asset and attack-surface management

Build up assets, endpoints, flows, and their relationships as graph state across operations.

Evidence and reporting

Capture evidence as artifacts and turn operation findings into shareable reports.

Repeatable assessment programs

Standardize methodology with playbooks so large teams run the same assessment the same way.