Frequently Asked Questions
Answers to common questions about Cracken. Expand a question to read its answer.
Tools and integrations
Is GitHub on the integration roadmap?
Yes. GitHub, GitLab, and similar integrations are in active development, with the goal of letting you integrate Cracken into your CI/CD pipeline.
Does Cracken have Burp Suite integration?
Not currently. Cracken supports connecting MCP servers, including Burp Suite, and its Tentacles can perform many of the same tasks through other tooling.
See MCP Servers for details.
Can I export the Knowledge base — into Confluence, for example?
Yes.
How do your integrations work, and what is the added value if I already use tools like Exploit-DB?
Cracken provides value on its own, even without external tools. The advantage is that it can bring many different tools to bear inside one unified interface.
See Integrations for details.
Compliance and legal
Do you hold any certifications (SOC 2, ISO, and similar)?
SOC 2 and ISO certification are in progress.
Who is accountable if something goes wrong, and where is the human in the loop on your end?
You are the human in the loop. Cracken acts under your control and within the autonomy level you configure.
See Semi-Autonomous Policy and Operations for details.
Deployment and sales
What enterprise options are available?
There are three options:
- SaaS (see below), the preferred option for its flexibility
- On-premises
- Hybrid
Contact sales@cracken.ai to discuss which fits your environment.
How are plans and credits structured?
Plans, resource limits, and how credits are consumed are covered on the Billing page.
For a quote, a custom configuration, or usage estimates tailored to your infrastructure, contact sales@cracken.ai or your Cracken account representative.
Security
How are data and credentials handled and protected?
Data and credentials stay local during testing; only selected, redacted results leave your network. Connections are TLS-encrypted, storage is encrypted at rest, and SSO, RBAC, and audit logs are supported. You can use your own secret manager and bring-your-own-key (BYOK) or self-hosted LLM endpoints for external commercial models to keep keys and prompts in-boundary.
See Deployment for details.
Is there a risk of data leakage between realms, and how is it prevented?
Each realm has its own context and Knowledge base. Realms do not cross-reference each other, and operations in one realm do not read or surface data from another.
See Realms for details.
Where is data stored for SaaS? Where are credentials stored? Do you support SSO and MFA?
SaaS data is stored on servers in the US and the UK. Cracken is SOC 2 aligned (formal certification is in progress). SSO, MFA, and federated login are supported.
How do I make sure Cracken doesn't ingest something malicious? What are the guardrails?
Installing any tooling requires approval. In addition, Cracken does not store tooling in the backend — tools and libraries live in the Tentacle, which can be isolated for safety.
AI behavior and governance
Can it run without internet if deployed on-premises? Does that affect performance?
Yes to both. A deployment can be fully air-gapped and still operate, provided the network where Cracken is deployed has either an endpoint for commercial LLMs or enough compute to host self-hosted models. Without real-time internet access, output quality is somewhat reduced, so performance is affected.
See Deployment for details.
Can I choose the AI models?
Operators can choose from the models exposed by the configured operation model catalog. If no model is selected, the operation uses the default model, or the model inherited from the selected playbook. Some models are plan-gated — the Red model, for instance, is available only to plans that include it and appears locked with a Talk to sales option otherwise. Red is enabled only on request through sales, never bundled into a plan.
See Operations for details.
Can you share details on the training data and model optimizations for tasks like network or vulnerability discovery?
We don't share those details. Benchmarks are planned for publication later this year.
How do I audit evidence?
Evidence is stored in the Cybergraph as an evidence node. Selecting it in the graph takes you to it, where you can see the output and the script used to generate it.
See Evidence for details.
How do you train your models, and where does the data come from?
Synthetic data is used heavily. Prompts and responses may contribute to model improvement depending on your plan and your model-training setting. On self-serve plans that support it, you can disable this from the Model Training card in Settings → Team Members, which marks outbound model requests for redaction. On sales-managed plans, model training is off and is governed by your Cracken agreement rather than by that toggle. Customer-specific fine-tuning is handled separately when explicitly requested. On self-hosted / on-premises deployments, participation in Cracken model improvement is forced off — prompts and responses do not contribute to it, and there is no Model Training card to configure. Data retention or training by an external LLM you configure (for example a direct commercial endpoint) is governed by that provider's own terms and configuration.
See Team Management for details.
How deterministic is the AI?
It is largely non-deterministic. Answers, strategies, and findings may vary from attempt to attempt.
How long and how deep does autonomous testing run?
A test runs as long as the operation needs to meet its requirements, which depends on the prompt and the environment under test. Using the system playbooks, a thorough penetration test averages 80–90 minutes from planning to report generation.
See Playbooks for details.
Platform architecture and deployment
What is the timeline for autonomy profiles?
Autonomy profiles are available now. Configure trust levels, infrastructure allowlists, and exception rules from your realm settings. See the semi-autonomous policy documentation for details.
Is Cracken SaaS, agent-based, an appliance, or hybrid?
Hybrid, with an agent-based execution layer.
See Tentacles for details.
How is it deployed to run internal infrastructure penetration tests?
For internal infrastructure testing, containerized execution agents are deployed inside your network to run enumeration, exploitation attempts, and validation close to the targets.
See Tentacles for details.
Can I host Cracken on my premises? Do I need to host the AI models too?
On-premises deployments come in two variants, hybrid and full. In a hybrid deployment, the backend runs on your premises but still connects to the models over the internet. A full deployment can be completely air-gapped: the backend and the self-hosted models both run on your premises, so the application functions without a connection to the outside world.
See Deployment for details.
Could Cracken assess assets from both an external (black-box) and internal perspective?
Yes — black-box, gray-box, and white-box.
Offensive security capabilities and operations
What are its penetration-testing capabilities (external web apps, internal infrastructure networks, Kubernetes environments)?
Cracken is environment-agnostic. It can be deployed against these environments and carries tooling to work in each.
Can it handle privilege escalation, gray-box and authenticated testing, and misconfiguration detection?
Yes to all three.
How does fuzzing work? Do I forward requests through your proxy?
A Tentacle can capture traffic, which is then used for fuzzing with the LLM or manually.
See Browser Vessel for details.
Do you have an XSS exploit so I can confirm whether a finding is a false positive?
Cracken includes tooling that can confirm an XSS finding, including the browser tooling for cases where JavaScript or forms render asynchronously.
See Browser Vessel for details.
How does scheduling work?
Cracken supports CRON-based scheduling through automations. Define a schedule, provide a task description, optionally attach a playbook, and Cracken launches operations at the specified intervals for continuous testing without manual intervention.
How does Cracken handle authentication during a penetration test?
If a target requires sign-in, add the credentials to the realm's Cybergraph and the AI uses them to log in when needed.
See Cybergraph for details.
How does Cracken deal with SSO?
Cracken provides a workflow where you sign in through the Cracken app and then download a session package, which lets the AI continue without further manual sign-in.
See Browser Vessel for details.
How can this save time for experienced penetration testers?
There are three ways Cracken aims to reduce the workload on penetration testers and red-teamers:
- Automation: semi-autonomous and autonomous modes let you offload work to the AI while you handle other tasks.
- Orchestration: even in manual mode, you can review and manage many operations at once — reviewing each command the AI proposes across operations, editing, approving, or denying actions — so you orchestrate as many operations as you can manage.
- Integration: Cracken aims to offer broad integrations, both for scanning and knowledge generation and for tooling.
See Semi-Autonomous Policy, Operations, and Integrations for details.
What about DORA?
Cracken works with European partners and is equipped to handle DORA-related compliance penetration tests. A pre-engineered DORA compliance campaign is in development with customers.
What kinds of vulnerabilities does it test for?
Cracken looks up information in real time and checks for current, recently disclosed vulnerabilities across a broad range of classes.
Is there a way to measure coverage — an overview of what has been touched?
Yes. There is a list of artifacts, and a realm-level Cybergraph gives a quick overview. You can also ask the AI for a status summary at any time. Progress-tracking views that visualize metrics like endpoints found and endpoints checked for specific vulnerability classes are in development.
See File System and Cybergraph for details.
How does the human in the loop work?
There are multiple layers of human control. First are the autonomy levels: automation can be turned off or limited to specific degrees or commands, and the AI does not act without consent unless you configure it to. Second, an operation or realm can be stopped, aborting every in-flight action immediately.
See Semi-Autonomous Policy and Operations for details.
Can it detect business-logic flaws?
Yes. Cracken is not a simple scanner — it can understand applications through visual reconnaissance, identify business logic, and check for logic flaws.
See Browser Vessel for details.
How do I know the AI found everything and worked through the entire checklist?
The AI is a non-deterministic tool. Like any model it can hallucinate or omit information, and it can fail the way humans do. For maximum confidence, have a human audit the findings, verify the steps taken, and review the evidence gathered. Cracken provides the tools to check and audit that information.
See Evidence and Operations for details.
Contact your Cracken account representative, or browse the rest of the documentation for more detailed guides.