Skip to main content
AegisAegis status: checking.
Agentic AI red team

The AI red teamthat follows the attackall the way down.

App, OS, infra and network. Every finding graded by how strongly it is proven.

See the demoRead the thesis

Open source · Self-hosted or hosted · Bring your own LLM

01 / Application

The code you ship and the endpoints it exposes.

Mode
Agentic engagement
Evidence
Validated proof-of-concept, replayable

Counted from the code, not estimated

OWASP LLM probes
18
in the shipped corpus
Attack-chain rules
6
multi-step reasoning
CI honeypot cases
8
pinned in CI, every run
Specialist skills
60
loaded on demand

Depth

Attackers don't respect your layers. Neither does Aegis.

  1. 01

    Application

    The code you ship and the endpoints it exposes.

    Mode
    Agentic engagement
    Evidence
    Validated proof-of-concept, replayable
    • Web apps
    • REST + GraphQL APIs
    • Mobile (Android, iOS)
    • Source code (whitebox)
    • LLM endpoints
    • Agentic AI workflows
    What it finds
    • Broken access control proven across two accounts the agent created
    • Injection chained to data the agent actually retrieved
    • Leaked credentials graded against the vendor blast radius

    A credential in application config is an operating-system door.

  2. 02

    Operating system

    How the host and its containers are configured.

    Mode
    Static configuration audit
    Evidence
    The configuration text itself, 27 checks
    • SSH (sshd_config)
    • TLS termination
    • Dockerfiles
    • Kubernetes and compose
    • Environment files
    What it finds
    • Root login and password auth left enabled on SSH
    • Container running privileged, or mounting the Docker socket
    • A real secret baked into an image layer

    A privileged container is a route to everything the host runs.

  3. 03

    Infrastructure

    The software the host is running, and its version.

    Mode
    Passive CVE correlation
    Evidence
    The version the target disclosed itself
    • nginx and Apache
    • OpenSSL
    • Tomcat
    • Microsoft IIS
    • PHP runtimes
    What it finds
    • A disclosed OpenSSL build inside the Heartbleed range
    • An nginx version matching a published advisory
    • A stack that announces its exact version to anyone who asks

    A known-vulnerable service is a foothold that needs no zero-day.

  4. 04

    Network

    What answers on the wire, and how it negotiates.

    Mode
    Gated active probe
    Evidence
    A completed handshake, consent on record
    • Open TCP ports
    • TLS protocol negotiation
    • Certificate validity
    • Service banners
    What it finds
    • A listener that still completes a TLS 1.0 handshake
    • An expired certificate on a live port
    • A banner handing an attacker an exact version to look up

Every finding at every layer carries a CWE. One language across all four layers.

Findings map to

  • OWASP
  • MITRE ATT&CK
  • MITRE ATLAS
  • D3FEND
  • NIST CSF
  • NIST AI RMF
  • PCI DSS 4
  • RBI
  • UAE Central Bank

A scenario

Monday night. Tuesday morning.

  1. 02:13

    Detect

    Application

    A payments API answers different users with the same shape.

  2. 02:14

    Expand

    Application

    Sibling endpoints share it. A privilege-escalation path appears.

  3. 02:18

    Prove

    Application

    A working PoC moves a small balance between two test accounts it created.

  4. 02:18

    Frame

    Application

    Rewritten as transaction volume and regulatory exposure, not CVSS.

  5. 02:41

    Descend

    Operating system

    The path ran through a credential in config. The operator runs the config audit: privileged container.

  6. 03:02

    Confirm

    Infrastructure

    Disclosed headers name an OpenSSL build in an advisory range. Passive, nothing sent.

  7. 08:30

    Report

    All layers

    On the dashboard by morning, each finding labelled with its mode and evidence.

The word that matters is not autonomous. It is reproducible.

What ships today

6 capabilities, every one open-library.

Agentic AI exposure

Pentest the agents, not just the app.

frameworks detected
7

frameworks detected

OWASP Agentic + LLM Top-10
T1-T15

OWASP Agentic + LLM Top-10

MITRE technique per threat
ATLAS

MITRE technique per threat

How it works

Detect the framework, map the tool surface, grade it against OWASP Agentic and the LLM Top-10. Severity and confidence stay separate, so a static match never poses as a proven exploit.

  • Frameworks read from imports and dependency manifests
  • Tool surface: code interpreters, shells, HTTP, RAG, MCP servers
  • Ships as a dashboard surface and an MCP tool
PoC validation

Every finding ships with a live replay.

4verdict states
How it works

Aegis replays each proof-of-concept against the target and pins the verdict beside the finding.

  • AND-logic across typed indicators
  • Refuses non-http(s) URLs by design
  • CI-friendly exit codes for gating
Attack-chain reasoning

From findings list to attack story.

6built-in chain rules
How it works

A rule registry walks validated findings into the multi-step escalation a human would write up.

  • Severity bumps to the highest constituent finding
  • Same envelope key on markdown, HTML, React, MCP
  • Stable chain ids across runs
Authenticated scans

Log in, then test.

4auth flows
How it works

Resolve a secret from your vault, run the flow, then test every probe behind the login.

  • form-post, basic, bearer, oauth_password
  • Plaintext credentials refused at parse time
  • SecureCredential wraps every resolved secret
Live operations

Watch it work, and stop it mid-flight.

resumableafter a crash, not restarted
How it works

A scan is a stream of typed events, not a black box that eventually returns. Pause it, inject an instruction, resume it, or let it recover on its own after the host dies.

  • Checkpointed on a cadence, so a killed process resumes where it stopped
  • An interrupted run still produces a report from the evidence it did gather
  • A hard dollar cap ends the run before the bill surprises anyone
Receipts on every action

Telemetry is the control plane.

100%cost reconstructible
How it works

Every LLM call, tool run, and dollar is a typed event. The dashboard shows the receipts, not a footnote.

  • Single canonical event stream per scan
  • Phoenix, Prometheus, and Grafana opt-in
  • A $0.0034 call renders as $0.0034

The other 8 on the deep dive: stack fingerprinting, the OWASP LLM runner, mobile, the skill catalog and more.

Architecture

Three front doors. One engine. Every step on the record.

01Front doors

Dashboard

Web console and API

CLI

28 verbs

MCP server

18 tools for AI clients

02Engine · one library under all three

Agent engagement

Application · runs in a Docker sandbox

Config audit

Operating system · static

CVE correlation

Infrastructure · passive

Active probe

Network · four gates

03Evidence pipeline · every finding, in order

  1. 1. Dedupe judge

    Hash is a hint; an LLM judge decides

  2. 2. Verifier

    Caps severity the evidence cannot carry

  3. 3. Scorer

    8 questions set the confidence tier

  4. 4. Mapper

    CWE to OWASP, ATT&CK, D3FEND, clauses

04Record and output

Evidence store

events.jsonlSQLite or Postgres mirror

The file is the source of truth. Every aggregate rebuilds from it.

Outputs

  • Report
  • SARIF
  • JUnit
  • ATT&CK Navigator
  • HackerOne
  • Bugcrowd
  • Webhooks
Fig. 1 · The shape of the platform. Agent topology and tool inventory are shared on request.

One finding · every framework

Evidence decides what a finding may cite.

Confidence tier

  1. CWE

    Finding

    SQL injection

    CWE-89

    Profile · banking

    PoC reproduced

  2. OWASP

    Top 10 · 2021

    A03Injection

  3. ATT&CK

    Techniques

    T1190Exploit Public-Facing ApplicationInitial Access
    T1059Command and Scripting InterpreterExecution

  4. D3FEND

    Countermeasures

    D3-ITFInbound Traffic FilteringIsolate
    D3-ACHApplication Configuration HardeningHarden
    D3-CFContent FilteringIsolate
    D3-PSEPProcess Segment Execution PreventionHarden

  5. Clauses

    Regulatory

    OWASPA03:2021 Injection
    ISO 27001:2022A.8.28 Secure coding
    NIST CSF 2.0PR.DS Data Security
    PCI-DSSReq 6.5.1 Injection flaws
    RBICyber Security Framework 2016, Annex 1.6
    CBUAEInformation Security Standard 4.3.2

    Verified evidence: compliance clauses are cited.

Fig. 2 · Output of the platform's own mapping code for this finding, not an illustration.

Network layer · safety model

Four gates before a single packet.

  1. 1

    Flag

    AEGIS_ACTIVE_SCAN on. Off by default.

  2. 2

    Tier

    Aggressive intensity, asked for explicitly.

  3. 3

    Scope

    Host in the allowlist. Cloud metadata refused.

  4. 4

    Consent

    Acceptable-use consent on record.

  5. Probe

    The host resolves once; every connection goes to that address, so DNS cannot rebind mid-scan.

Each gate fails closed on missing input. The same four run from the dashboard, the CLI and MCP.

Operating principles

Four claims the platform is built to defend.

  1. 01

    Reasoning, not signatures.

    Scanners catch what is already named. Reasoning catches what is next.

  2. 02

    Reproducible adversarial work.

    Every finding ships with the chain of inference that produced it.

  3. 03

    Compute economics.

    Coverage decouples from headcount. The unit is no longer the consultant-hour.

  4. 04

    Audit as the control plane.

    Every token, tool call and dollar, visible to operators, auditors and boards.

Why these four: read the whitepaper

Pricing

Free to self-host. Hosted when you want it. Air-gapped when you need it.

Community
Free
  • 5 scans per month
  • 1 target
  • Basic report
  • Community support
  • Self-hosted only
Run self-hosted
Pro
$249/mo
  • Unlimited scans
  • 10 targets
  • CI/CD integration
  • PDF + dashboard
  • Slack alerts
  • Email support
Start Pro
Team
$999/mo
  • Everything in Pro
  • 50 targets
  • RBAC & SSO
  • Compliance reports
  • Priority support
  • Custom rules
Get in touch
Enterprise
Custom
  • Unlimited targets
  • Self-hosted / air-gapped
  • BYO LLM
  • Kill switch & audit
  • Founder-led onboarding
  • Custom SLA
Get in touch

Every tier enforces the same per-scan budget cap, real-time spend visibility, and dollar-per-finding telemetry. The tier governs how many scans you can run, not how the platform behaves on each one.

Private beta

Get in touch. A person reads every message.

Maintainer
Aegis App

The team that builds Aegis and replies.

Email
redteam.aiagent@gmail.com
Reply window
Usually within a day. Always within three.
What is this about?

Replies go to your inbox.