Penetration Tester Resources

Getting Started with the Praetorian CLI

CLI Basics

Overview of Courier and its Control, Planner, and Webflows tabs

Courier for Burp Suite

Connect Courier to Guard and configure capture and activity settings

Courier Control Tab

Queue Burp evidence and use it in Guard Planner conversations

Courier Planner Tab

Record and review browser workflows with Courier

Courier Webflows Tab

Resources for security analysts using Guard in their daily workflow

Analyst Resources

Connect Guard's Marcus Slack app to receive rich Block Kit notifications and run identity-verified queries and actions directly from Slack channels.

Slack – Marcus Chat Integration

How to connect Guard to Slack so your team can receive security findings and interact with Guard directly from Slack channels.

Slack Chatbot Integration

Get started with the Praetorian Guard Platform — your AI-powered offensive security platform

Welcome to Praetorian Guard

What is Praetorian Guard?

Adding Your First Seeds

Quick Start Guide

Understanding Your Dashboard

Learn the basics of interacting with Praetorian Guard Platform

Getting Started with Praetorian Guard Platform

How Guard discovers, scans, and monitors your attack surface

Scanning & Discovery

Static domain deny lists and per-account capability blocks enforced at job enqueue.

Scanning Policy: Protected Domains and Blocked Capabilities

How the automated Helix → Nuclei pipeline validates CVE researcher-generated detection templates against real targets before they reach the detection fleet.

Nuclei Template Validation Pipeline

Sign-Up and User management

Signing Up For the First Time

Role-Based Access Controls (RBAC)

SSO Domain Verification

Okta SSO Configuration

Azure SSO Configuration

PingID SSO Configuration

How to configure SCIM 2.0 provisioning so that an enterprise identity provider such as Okta or Microsoft Entra ID automatically manages Guard user accounts and roles, including group-to-role mapping.

SCIM 2.0 Provisioning

Account Creation and Attack Surface Setup

Multi-Factor Authentication Setup

Overview of the Integrations page, including integration categories, configuration, integration health states, integration-suggestion prompts, and the legacy AWS integration badge.

Integrations

Exposure Notifications

Rules of Engagement (RoE) for Continuous Internal Security Testing

How the A–F letter grade and 0–100 Internet Perimeter Score on Insights → Metrics are calculated, what risks count, and when the score updates.

How Your Internet Perimeter Score and Grade Are Calculated

Progressive AI capabilities from inference to autonomous offensive security operations

AI Enablement

AI Overview

Aurelius: The AI Operator

Query Mode

Agent Mode

Reconnaissance Agents

Scanning Agents

Offensive Agents

Validation Agents

Automated Agents

How the Affiliation Agent verifies asset ownership and detects dangling DNS

Asset Affiliation Agent

How to configure per-category AI spend budgets in Guard, including disabling spend for a specific capability by setting its allocation to zero.

AI Budget

Configure a per-tenant allowlist and priority order for LLM providers that Guard uses across all AI capability workloads.

AI Provider Preferences

How to view cumulative subscription-to-date and monthly AI spend in Guard settings.

AI Spend Tracking

Quantifying enterprise risk requires examination of all the angles

Attack Surfaces

Application Attack Surface

CICD Pipeline Surface

Cloud Attack Surface

External Attack Surface

Internal Attack Surface

LLM Attack Surface

Source Code Surface

User Attack Surface

Understand the core modules of Praetorian Guard: Continuous Offensive Security, Attack Surface Management, Vulnerability Management, and Breach & Attack Simulation

Platform Modules

Attack Surface Management (ASM)

Cyber Threat Intelligence (CTI)

Penetration Testing & Application Security

Breach & Attack Simulation (BAS)

Configure host-to-IP overrides so Guard can scan hosts that do not resolve correctly from its scanning vantage point.

Per-Account DNS Pinning for Unresolvable Hosts

Configure host-to-IP overrides so Guard can scan hosts that do not resolve correctly from its scanning vantage point, with IP ownership verification and a full audit trail.

Host Overrides: Pin Hosts to Specific IPs

How Guard notifies admin users of expired or invalid integration credentials at sign-in and how to resolve the prompt.

Integration Credential Alert Modal

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

How to configure per-tenant Cato auto-triage sources, severities, and understand AI budget attribution for automated triage runs.

Cato Auto-Triage Configuration

How Guard automatically scans for high-severity CVEs, detects them in your environment, launches exploitation hunts, and delivers a three-stage notification sequence.

Emergent-Threat CVE Automation

A guided three-phase onboarding wizard that takes new freemium tenants from domain seed through automated attack-path analysis in a single session.

Freemium Onboarding Wizard

An overview of the onboarding walkthrough that guides new Guard users through the platform's core sections on first login.

First-Time User Guided Walkthrough

Configure automated, recurring hunt execution against defined targets using daily, weekly, or monthly schedules.

Hunt Scheduling and Cadence Controls

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

How to use the redesigned AI settings page to schedule autonomous penetration tests, manage category allocation, and configure AI spend as separate, role-appropriate controls.

AI Settings Page — Scheduled Penetration Tests and Category Allocation

How to find and use the dedicated AI Settings tab in Guard, which consolidates all AI configuration in one place.

AI Settings Tab

How to independently configure and schedule Hannibal autonomous penetration tests from AI Settings without requiring Praetorian involvement.

Self-Service Scheduling for Autonomous Penetration Tests

Query per-customer AI and compute costs broken down by period and customer type using the cost economics API.

AI and Compute Cost Visibility per Customer

How to configure per-tenant AI model vendor opt-outs so Guard automatically substitutes equivalent-tier models from permitted providers.

AI Model Vendor Preferences

An overview of the Guard Console v1.1 visual refresh, covering the updated design language, typography, component primitives, and restyled sections.

Guard Console v1.1: Refreshed UI

Praetorian's open-source Caesar-named capabilities integrated into Guard

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Jail Breaking

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 23+ protocols, username enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian: API Security Testing

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula: Software Supply Chain Security Scanner

How Guard's PCI ASV scoring engine evaluates scan results against CVSS source-order rules and auto-fail criteria to produce a deterministic pass/fail verdict for ASV reporting.

PCI ASV CVSS Scoring Engine and Pass/Fail Gate

Discover which email addresses in your domain correspond to active Microsoft 365 identities using Guard's Teams account enumeration capability.

Microsoft Teams Account Enumeration

Aegis lets you enroll agents on your own infrastructure so Guard capabilities — including Hannibal internal hunts and AI-driven agent execution — can run against internal assets that are unreachable from Guard's compute.

Aegis: Run Guard Capabilities on Your Own Infrastructure

Pre-authentication detection of sticky-keys and utilman accessibility-tool backdoors on in-scope RDP endpoints.

RDP Logon-Screen Backdoor Detection

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface: APK Upload and Decompilation

Deception & Decoy Environments (Knossos)

Insights

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Overview of reporting and export functionality in the Praetorian Guard Platform

Reporting and Exports

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

Assets

Assets are the foundation of your attack surface in Guard, representing everything externally discoverable that belongs to your organization.

Vulnerabilities

How to triage, track, and resolve security vulnerabilities Guard discovers across your attack surface.

How to browse, filter, preview, and launch Nuclei templates from the Signatures catalog on the Vulnerabilities page.

Signatures Catalog

Threats

Threat Intelligence

Attacks

Automatically ingest evilginx adversary-in-the-middle credential and session captures into Guard phishing campaigns, retrieve captured session loot via API, and receive real-time webhook notifications when sessions are captured.

Evilginx Capture Pipeline, Loot API, and Webhook Notifications

How to attach a custom tag when launching a Hannibal hunt so that every finding from that hunt can be filtered, tracked, and reported on independently.

Per-Hunt Custom Finding Tags

Detections

Knossos User Guide

Connect third-party security tools, cloud providers, and IT services to Guard

Security ratings platforms that score your external security posture

Security Ratings

Connect Black Kite to Guard to automatically import third-party cyber-risk assets and vulnerability findings.

Black Kite

Connect Guard to SecurityScorecard to import third-party security ratings, risk factor scores, and actionable issue findings with evidence and remediation guidance.

SecurityScorecard

Integrations Overview

Knowledge Bases

Confluence

Application Security Posture Management

Import application risks, code repository inventory, and security findings from Apiiro into the Guard Platform.

Apiiro

Import consolidated security findings from ArmorCode's application security orchestration platform into the Guard Platform.

ArmorCode

Import application assets, risk scores, and coverage gaps from Snyk AppRisk into the Guard Platform.

Snyk AppRisk

Import application security findings from Aikido Security into the Praetorian Guard Platform as risks on code repositories and domains, with automatic vendor-closure sync and optional two-way write-back.

Aikido

Application Security Testing (AST)

Burp Enterprise

Snyk DAST

Invicti

Breach Attack Simulation

Cymulate

SafeBreach

AttackIQ

Bug Bounty

Connect HackerOne bug bounty programs to Guard to import vulnerability reports as risks and program scope — including source code repositories — as seeds.