<h2>Deception Environments</h2>Deception is the third section on Settings → Organization. Section copy: Generate and deploy canary decoy environments with Knossos.The card is Deception Environments: Generate and deploy canary decoy environments with Knossos.Customers see the switch. It is Managed by Praetorian — you cannot flip it. Only a Praetorian operator (or <code>admin@praetorian.com</code>) can enable it. Enabling confirms: Enabling Deception Environments allows admin users on this account to generate, deploy, and manage canary decoy infrastructure.Static IP is not on this tab (it is on Settings → Scanning). Allowed email domains and tenant deletion on this tab are Praetorian-only.When the flag is on, decoy environments are managed from Detections.

The Knossos decoy toggle on Settings → Organization — customers see it; Praetorian turns it on.

Deception Environments

Get started with the Praetorian Guard Platform — your AI-powered offensive security platform

Welcome to Praetorian Guard

What is Praetorian Guard?

Quantifying enterprise risk requires examination of all the angles

Attack Surfaces

Application Attack Surface

CICD Pipeline Surface

Cloud Attack Surface

External Attack Surface

Internal Attack Surface

LLM Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface

Source Code Surface

User Attack Surface

Understand the core modules of Praetorian Guard: Continuous Offensive Security, Attack Surface Management, Vulnerability Management, and Breach & Attack Simulation

Platform Modules

Attack Surface Management (ASM)

Breach & Attack Simulation (BAS)

Cyber Threat Intelligence (CTI)

Penetration Testing & Application Security

The Ludacris-only product module: a counted red-team engagement per year, run by Praetorian — not a customer self-serve Attacks tab.

Red Teaming

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

Unified Vulnerability Management

Praetorian's open-source Caesar-named capabilities integrated into Guard

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Jail Breaking

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 23+ protocols, username enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian: API Security Testing

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula: Software Supply Chain Security Scanner

Discover which email addresses in your domain correspond to active Microsoft 365 identities using Guard's Teams account enumeration capability.

Microsoft Teams Account Enumeration

Aegis lets you enroll agents on your own infrastructure so Guard capabilities — including Hannibal internal hunts and AI-driven agent execution — can run against internal assets that are unreachable from Guard's compute.

Aegis: Run Guard Capabilities on Your Own Infrastructure

Pre-authentication detection of sticky-keys and utilman accessibility-tool backdoors on in-scope RDP endpoints.

RDP Logon-Screen Backdoor Detection

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Knossos: Deception & Decoy Environments

Automatically ingest evilginx adversary-in-the-middle credential and session captures into Guard phishing campaigns, retrieve captured session loot via API, and receive real-time webhook notifications when sessions are captured.

Evilginx Capture Pipeline, Loot API, and Webhook Notifications

An overview of the onboarding walkthrough that guides new Guard users through the platform's core sections on first login.

First-Time User Guided Walkthrough

Multi-Factor Authentication Setup

Signing Up For the First Time

Learn the basics of interacting with Praetorian Guard Platform

Getting Started with Praetorian Guard Platform

Insights

How the A–F letter grade and 0–100 Internet Perimeter Score on Insights → Metrics are calculated, what risks count, and when the score updates.

How Your Internet Perimeter Score and Grade Are Calculated

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Overview of reporting and export functionality in the Praetorian Guard Platform

Reporting and Exports

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

How to use the Aurelius scan attribution skill to confirm whether scanning activity observed on your infrastructure originated from the Guard platform.

Scan Attribution

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

How to configure authenticated scanning for each Web Application seed using Automated Authentication, Use Existing Token, or Manual Login Flow.

Authenticated Scanning for Web Applications

Assets

Assets are the foundation of your attack surface in Guard, representing everything externally discoverable that belongs to your organization.

Vulnerabilities

How to triage, track, and resolve security vulnerabilities Guard discovers across your attack surface.

How to browse, filter, preview, and launch Nuclei templates from the Signatures catalog on the Vulnerabilities page.

Signatures Catalog

How Guard automatically scans for high-severity CVEs, detects them in your environment, launches exploitation hunts, and delivers a three-stage notification sequence.

Emergent-Threat CVE Automation

Threats

Threat Intelligence

Attacks

How to attach a custom tag when launching a Hannibal hunt so that every finding from that hunt can be filtered, tracked, and reported on independently.

Per-Hunt Custom Finding Tags

Detections

Knossos User Guide

How the automated Helix → Nuclei pipeline validates CVE researcher-generated detection templates against real targets before they reach the detection fleet.

Nuclei Template Validation Pipeline

How to use the Detections page in Guard, including BAS results, gap analysis, and Automatic Findings Validation settings.

Connect third-party security tools, cloud providers, and IT services to Guard

Integrations

Security ratings platforms that score your external security posture

Security Ratings

Integrations Overview

Knowledge Bases

Application Security Posture Management

Application Security Testing (AST)

Breach Attack Simulation

Bug Bounty

Cloud

Cloud Security Posture Management

Content Delivery Solutions

Cyber Asset Attack Surface Management

Endpoint Detection Response

Firewalls

Identity and Access Management

Integrate with popular ITSM solutions such as ADO, Freshdesk, Freshservice, and JIRA

IT Service Management (ITSM)

Mobile Device Management

Managed DNS Providers

Passive DNS Providers

SaaS Security

Secure Code Scanning

Security Information and Event Management (SIEM)

Integrate with popular source code managers such as ADO, Bitbucket, Github, and Github

Source Code Managers

Integrate with popular vulnerability scanning tools such as Qualys, Tenable, and Rapid7

Vulnerability Management (VM)

Workplace Messaging

Overview of the Integrations page, including integration categories, configuration, integration health states, integration-suggestion prompts, and the legacy AWS integration badge.

How Guard notifies admin users of expired or invalid integration credentials at sign-in and how to resolve the prompt.

Integration Credential Alert Modal

Deliver Guard findings into your ticketing and IT service management tools, and find the full integration catalog.

Integrations & Ticketing

Endpoints

Agent Installation and Deployment Guide

How to download agent testing logs for Hannibal findings to review the agent's reasoning and evidence trail.

Agent Testing Logs

Jobs

Monitor running and completed jobs through the Jobs page and the Activity Hub in the top navigation bar.

Documents

How to upload, download, manage visibility, and secure files in the Praetorian Guard Platform.

Files

Settings

Settings → SCIM: IdP connection, provisioning, and group role mapping.

SCIM

Settings → Subscription: current plan, coverage, and available tiers.

Subscription

Settings → Users: authorized users, invitations, collaborators, and RBAC.

Users

Settings → Organization: profile, SSO, compliance frameworks, and deception.

Organization

Settings → AI: feature flags, spend, providers, automatic penetration tests, and automatic findings validation.

Settings → Scanning: status, header, level, source IP, host pins, schedule, and intensity.

Scanning

Settings → Notifications: email, outbound webhooks, chat, ITSM, exposure alerts, inbound webhook, and scheduled reports.

Notifications

Who signed in to this account, from Settings → Access Logs.

Access Logs

Asset counts from the last scan, from Settings → Monitoring.

Monitoring

Progressive AI capabilities from inference to autonomous offensive security operations

AI Enablement

AI Overview

Aurelius: The AI Operator

Query Mode

Agent Mode

Reconnaissance Agents

Scanning Agents

Offensive Agents

Validation Agents

Automated Agents

How the Affiliation Agent verifies asset ownership and detects dangling DNS

Asset Affiliation Agent

Enterprise Security

AI Security

AI Data Privacy

AI Data Privacy and Tenant Isolation

AI Operational Guardrails

AI Output Accuracy and Grounding

AI Audit Trail and Observability

Responsible AI Principles

Data Security

Secrets Management

Secure Delete

Cryptographic & Algorithmic Standards

Transport Security

Infrastructure Security

Regional WAF attached to API Gateway: rate limiting and managed rule groups.

AWS WAF for API Protection

How Guard workloads run in a private VPC with controlled egress and interface endpoints.

VPC, Private Subnets, and Service Connectivity

Certification

Overview of Praetorian's CREST membership, what it covers, and how it applies to security services delivered through the Praetorian Guard Platform (PGP).

CREST Membership Certification

SOC 2 Type 2 Certification

How Guard's PCI ASV scoring engine evaluates scan results against CVSS source-order rules and auto-fail criteria to produce a deterministic pass/fail verdict for ASV reporting.