Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

BoxPwnr-Traces

BoxPwnr-Traces BoxPwnr traces and benchmark results across multiple security platforms. Each trace includes the full LLM interaction, commands executed, a markdown report + attack graph, stats and config used. Browse leaderboards, replay runs in an interactive web viewer, and read AI-generated...

Thunderstorm

Thunderstorm You don't have 4,000 findings. You have six paths to your crown jewels. A CSPM hands you a flat, deduplicated, severity-sorted list of misconfigurations and leaves you to guess which ones matter. Thunderstorm reasons about reachability : it collects your cloud read-only, models it as...

Adalanche

Adalanche Código Abierto Visualizador y Explorador de Grafos de Ataque Adalanche ofrece resultados instantáneos, mostrándole qué permisos tienen los usuarios y grupos en un Directorio Activo. Es útil para visualizar y explorar quién puede tomar el control de cuentas, máquinas o el dominio complet...

Bounded Reasoning: Cognitive Hierarchy in Human-Versus-AI Cyber Defense

Human-agent evaluations often compress interaction into a single performance score, even when human and automated policies adapt differently over time. We study this in a sequential cyber-defense game on an attack graph, where a human or reinforcement-learning defender protects cloud assets again...

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis

Cyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces. This...

Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting

Logic attack graphs grounded in scanner output provide explicit and auditable attack path reasoning LLM-based agents lack. Integrating symbolic frameworks such as MulVAL to contemporary security workflows or agentic pipelines, however, requires translating scanner evidence to initial facts, and...

Merging Cyber Threat Intelligence through Retrieval-Augmented Generation and Small Language Models for Rich Threat Representation

Modern cybersecurity operations rely on CTI collected from heterogeneous sources, including semi-structured threat representations, IoCs, and narrative technical reports. However, these artifacts are often insufficient in isolation to reconstruct how an attack unfolds, under which conditions each...

From Security Events to Conflict States: A Three-Layer Cyber Defense Scenario Model for Enhanced Cyber Situational Awareness

Cyber defense in mission-critical environments requires integrated approaches capable of representing adversarial progression, defender-side uncertainty, mission impact, and defensive decision support within a unified framework. In operational domains, defenders must continuously estimate the...

MazeRunner: Nonlinear Task and Clue Orchestration for LLM-Driven Black-Box Automated Penetration Testing

Penetration testing is essential yet resource-intensive. Although large language models LLMs show promise for automating security auditing, existing agents mainly execute end-to-end workflows in simplified linear scenarios. Real-world black-box testing is fundamentally nonlinear: the attack graph...

Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening

Microsoft's Active Directory AD is a directory service that enables the IT admin to manage security permissions and control access within a Windows domain network. As a core management system in many of organisation, AD has become a primary target for adversaries. While many solutions for hardeni...

GARAGE: Characterizing the Automation Boundary in LLM-Based Attack Graph Generation

While modern vehicle security depends on effective Cyber Threat Intelligence CTI synthesis, current automated tools struggle with unstructured data and automotive-specific architectural nuances. To bridge this gap, we introduce GARAGE, a RAG-powered framework that converts fragmented CTI into an...

GPO Attack Graph Enrich

Merge GPO local group / privilege findings into the agent attack graph using LDAP-derived GPO scope when available. !/usr/bin/env python3 -- coding: utf-8 -- """ Merge GPO audit findings into the agent attack graph. Accepts a JSON export from GPO scanners plus an optional LDAP scope map. """ from...

Import BloodHound Graph

Merge BloodHound nodes/edges JSON into the agent attack graph for lightweight path planning without Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """ Import BloodHound JSON export into the agent attack graph. Set exportpath to nodes.json, edges.json, or a directory containing both. The merged...

GCP Attack Graph

Build an IAM and resource attack graph for the current principal and project !/usr/bin/env python3 -- coding: utf-8 -- import re from collections import defaultdict from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Attack Graph",...

AINEE

Autonomous Internal Network Exploitation Engine The Autonomou...

pentestai

PentestAI Autonomous penetration testing framework for intent...

Game-Theoretic Modeling of Stealthy Intrusion Defense against MDP-Based Attackers

The rapid expansion of Internet use has increased system exposure to cyber threats, with advanced persistent threats APTs being especially challenging due to their stealth, prolonged duration, and multi-stage attacks targeting high-value assets. In this study, we model APT evolution as a strategi...

Dynamic Causal Attack Graph Based Cyber-Security Risk Assessment Framework for CTCS System

Protecting the security of the train control system is a critical issue to ensure the safe and reliable operation of high-speed trains. Scientific modeling and analysis for the security risk is a promising way to guarantee system security. However, the representation and assessment of the...

Perry: a High-Level Framework for Accelerating Cyber Deception Experimentation

Cyber deception aims to distract, delay, and detect network attackers with fake assets such as honeypots, decoy credentials, or decoy files. However, today, it is difficult for operators to experiment, explore, and evaluate deception approaches. Existing tools and platforms have non-portable and...