FDA specifies what a penetration test report must contain. Cracken runs the test that fills it.

It produces most of what the guidance lists. FDA's guidance on cybersecurity in medical devices, issued 3 February 2026, states: "Penetration testing. · The testing should identify and characterize security-related issues via tests that focus on discovering and exploiting security vulnerabilities in the product. Penetration test reports should be provided and include the following elements: · Independence and technical expertise of testers; · Scope of testing; · Duration of testing; · Testing methods employed; and · Test results, findings, and observations." Scope, duration, methods, results and findings come out of the operation ledger as the run happens. Independence and technical expertise is a statement you make about who ran the test. FDA does not clear tools, and Cracken is not an accredited laboratory. — Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Final guidance, supersedes the 27 June 2025 edition, U.S. Food and Drug Administration (CDRH/CBER), 2026-02-03)

Yes, across the programme the device sits in: the management and clinician portals under the Web App Pentest playbook, the cloud back end that receives telemetry under Cloud Pentest, the segment the devices and lab systems sit on under Network Pentest, and the directory that administers them under AD Pentest. Firmware, radio stacks and embedded controllers are covered by the OT/ICS and malware-research playbooks. Scope is fixed against a realm allowlist before anything runs.

Only what you authorise, and only at the intrusiveness you set. Targets are fixed against a realm allowlist before anything runs, and a target outside it stops the run. Approval on each command is the default until you raise the ceiling. Every command, result and artifact lands in the operation ledger, so the record a change-control reviewer wants is written while the run happens rather than reconstructed afterwards. Where change control forbids testing the qualified system, the Tentacle goes on the qualified non-production replica and the same scope runs there.

Cracken tests your side of it. A Tentacle placed on an authorised host in the segment a partner's access lands in shows what that access actually reaches: which hosts answer, which credential path leads out of that segment, and where the boundary stopped the attempt. The partner's own estate is a separate target that needs the partner's written authorisation and a scope of its own. Cracken will not run against a system you cannot authorise.

The original report, not a summary of one. FDA's 3 February 2026 guidance states: "For any third-party test reports, manufacturers should provide the original third-party report. For all testing, manufacturers should provide their assessment of any findings including rationales for not implementing or deferring any findings". A Cracken run outputs that artifact: the scope, the commands, the captured signal, and each finding with the evidence of the operation that reproduced it, plus what could not be proven, named separately from what was. The assessment of the findings, and the rationale for anything you defer, stays yours to write. — Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Cybersecurity Testing section, U.S. Food and Drug Administration (CDRH/CBER), 2026-02-03)

The evidence is published rather than asserted. The team's paper Red-Teaming the Agentic Red-Team reports: "Table 3 reports the attack success rate aggregated across the 10 agentic-red-teams. On average, code execution is achieved in 97.8% of runs." — alongside a security analysis spanning twelve agentic tools. Two public repositories are readable before you scope anything: Blacksea, an active honeypot for LLM-driven attackers, and RedLineBench, 153 grounded, single-turn offensive-security prompts scored on refusal and capability, where every target domain and public IP is a sinkhole Cracken owns. — Red-Teaming the Agentic Red-Team (arXiv:2606.24496) (arXiv — Pasquini, Bazyli, Fedynyshyn, Sorokin, 2026-06-23)