RUN THE FULL KILL CHAIN ON YOUR OWN ORGANIZATION. BEFORE AN ATTACKER DOES.

Authorized, under your command, inside your network.

Try it now

See the model

// Where an attacker goes

01 Compromise a person
02 Cross identity
03 Exploit systems
04 Persist + move
05 Hijack the agent
06 Critical impact

app.cracken.ai — realm operation

// The model

Cyber opened. Everything else still refuses.

Performs the authorized offensive work every guarded frontier endpoint declines.

MODEL

Enabled on request — Red is never bundled into a plan.

Aligned no-cyber-refusal
Redshift — hands the step off the moment a model refuses
Frontier models plug in — bring Anthropic, Google, Meta or your own

UNIQUE HARNESS

Distributed Tentacles
Shared filesystem
Cybergraph
Cyber orchestration
A playbook plans the engagement and dispatches specialist sub-operations — recon, testing, verification — each with its own tools and model.

PLAYBOOKS

Phases, model and tools, pinned before anything runs.

See the five playbooks

// Deciding against something else?

Every alternative stops somewhere.

Compare to others on the pricing page

// Safe by design

Offensive and safe.

Nothing runs above the intrusiveness level you allow, or against a target outside your scope.

Above the level you allow, the run proposes the action and stops.

Human in & on the loop

Manual holds every action for approval. Semi puts you on the loop, not in it.

Unique semi-autonomy

Set per operation. Where sub-operations exist it cascades to them by default, and you can scope it back to one.

Group killswitches

Pause, resume and autonomy changes cascade to the whole sub-operation tree, not just the one you clicked.

Sandboxing

Each Tentacle runs isolated, and its egress can be pinned to a fixed, revocable IP.

Secret scanning & redaction

The model gets a reference, never the value — and output is stripped as it streams.

Operation ledger

Every action and the reasoning behind it, recorded in sequence as the operation runs — and every node type carries a link back to the work that produced it.

// Auto-approve up to

Passive
Web research, Cybergraph queries
Read only
curl GET, dig, whois, ping
Enumeration
nmap, masscan, ffuf, gobuster
Validation
curl POST, exploiting a vulnerability
Destructive
rm -rf, mkfs, passwd changes

Reaching the destructive rung takes a custom policy — no preset goes there.

Read the paper (arXiv:2606.24496)

// Deployment

Deploy anywhere.

Nothing has to leave your network.

+arrives inside your boundary. Everything else was already where it is.

01
SaaS
- backend
  runs at Cracken · US / UK
- database
  runs at Cracken · US / UK
- model
  commercial endpoint
- tentacle
  on hosts you control
Nothing is delivered — the Tentacle is already yours, on your hosts.
02
Private cloud
- backend
  into your tenancy
- database
  into your tenancy
- model
  endpoint, or self-hosted
- tentacle
  on hosts you control
Credentials and synced findings stay inside.
03
On-premises
- backend
  your infrastructure
- database
  your infrastructure
- model
  self-hosted
- tentacle
  on hosts you control
Only selected, redacted results leave.
04
Air-gapped
- backend
  your infrastructure
- database
  your infrastructure
- model
  self-hosted, or a reachable endpoint
- tentacle
  on hosts you control
Removed: ~~the live internet link.~~ Output quality is somewhat reduced without it.

Execution never moves.The Tentacle never arrives, because it never left — it runs on hosts you control in every mode, including SaaS.

Try it now Read the deployment guide

// Execution

Distributed Tentacles.

Execute next to your target, or wherever you have the compute.

Shared filesystem — one store every Tentacle reads and writes.

Scanners only look at CVEs. What I want is to give the agent part of the network and ask it what it would do if it were an attacker.

Red team operations lead, global bank

Four connected Cracken Tentacles, each running Linux next to its own target. — app.cracken.ai · tentacles — connected Tentacles on one realm

// Shared memory

Cybergraph.

Every host, service and finding a run touches is stored and typed. The next run starts from what you already know instead of scanning for it again.

// Traversalfirst_seen_at · last_seen_at · lifecycle · evidence → operation record

Netblockipv4range
CONTAINS
IPAddressipv4address · internal
CONTAINS
Portport_number
COMMUNICATIONprotocol · port · direction
Servicebanner · port_number

Three edge types, and only three. The third is TECHNIC — MITRE ATT&CK references, Exploit → Vulnerability.mitre_id · tactic · technique_name

app.cracken.ai — realm cybergraph, table view

The realm Cybergraph in table view: every row a node typed url, evidence, finding, ipaddress or vulnerability, with its severity beside it.

Start a realm

// Tradecraft

Five tradecraft playbooks ship pre-built.

It drives your tools. Your coding agent drives it.

One direction: the connectors for your stack, plus the offensive tooling it lacks. The other: Cracken is an MCP server, so Claude Code or Cursor can run operations from where you already work.