Threat Intelligence

Connect Recorded Future to enrich CVEs with risk scores and import threat actor and malware intelligence.

Recorded Future

Check the public IP addresses and domains Guard discovers against Proofpoint ET Intelligence and flag any tied to malware activity.

Proofpoint ET Intelligence

Get started with the Praetorian Guard Platform — your AI-powered offensive security platform

Welcome to Praetorian Guard

An overview of Guard's five modules, from attack surface management to breach and attack simulation, and its attack agents.

What is Praetorian Guard?

Quantifying enterprise risk requires examination of all the angles

Attack Surfaces

How Guard discovers your web applications and APIs, maps their authentication, and tests them for security vulnerabilities.

Application Attack Surface

How Guard scans your CI/CD pipelines across GitHub, GitLab, Azure DevOps, and Jenkins for supply-chain risks.

CICD Pipeline Surface

How Guard connects to your cloud accounts to inventory resources and find public exposures, secrets, and misconfigurations.

Cloud Attack Surface

How Guard discovers and tests everything your organization exposes to the public internet, starting from your seeds.

External Attack Surface

How Guard assesses your Active Directory and tests internal network services for weak credentials.

Internal Attack Surface

How Guard finds the LLM and AI services in your environment and tests them for prompt injection and related risks.

LLM Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface

How Guard discovers your repositories and scans them for vulnerabilities, exposed secrets, and pipeline weaknesses.

Source Code Surface

How Guard finds breach-exposed employee email addresses on your domains and flags domains open to email spoofing.

User Attack Surface

Understand the core modules of Praetorian Guard: Continuous Offensive Security, Attack Surface Management, Vulnerability Management, and Breach & Attack Simulation

Platform Modules

How Guard expands your seeds into discovered assets, suggests new seeds for approval, and tracks each asset's status.

Attack Surface Management (ASM)

How Guard scores each simulated MITRE ATT&CK technique from Prevented to Undetected and rolls them into a posture score.

Breach & Attack Simulation (BAS)

How Guard enriches CVE findings with CVSS, CISA KEV, EPSS, MITRE ATT&CK techniques, and CWE weaknesses.

Cyber Threat Intelligence (CTI)

How Guard runs offensive agents like Julius, Hadrian, Trajan, and Brutus, and has Praetorian operators validate findings.

Penetration Testing & Application Security

The Ludacris-only product module: a counted red-team engagement per year, run by Praetorian — not a customer self-serve Attacks tab.

Red Teaming

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

Unified Vulnerability Management

Praetorian's open-source Caesar-named capabilities integrated into Guard

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Vulnerability Scanner

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 43+ protocols, a cumulative credential corpus for cross-service reuse testing, account enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, repository security review workflow, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian is a security testing framework for REST, GraphQL, and gRPC APIs that tests for OWASP API vulnerabilities using role-based authorization testing and YAML-driven templates.

Hadrian: API Security Testing

How Julius, Praetorian's open-source tool, identifies the LLM serving software, such as Ollama or vLLM, behind an endpoint.

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

How Pius, the open-source tool behind Guard's asset discovery, maps your domains, subdomains, and IP ranges.

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula scans software supply chains for known vulnerabilities, malicious packages, compromised AMIs, and IaC image references across 7 ecosystems and 12 manifest formats, integrated natively into Guard.

Caligula: Software Supply Chain Security Scanner

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Knossos procedurally generates realistic decoy cloud environments so attackers waste time in fake infrastructure instead of yours.

Knossos: Deception Environments

Learn the basics of interacting with Praetorian Guard Platform

Getting Started with Praetorian Guard Platform

Insights

How Guard turns your open, validated internet-facing risks into the A–F grade and 0–100 score on the Metrics page.

How Your Internet Perimeter Score and Grade Are Calculated

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Insights → Metrics: track vulnerabilities, assets, and remediation trends across customizable dashboard widgets.

Metrics

Insights → Benchmarks: see your coverage across MITRE ATT&CK, D3FEND, EMB3D, NIST CSF, and FDA Premarket.

Benchmarks

Insights → Query Builder: build, run, and save graph queries across your assets, risks, ports, and cloud resources.

Query Builder

Explore entity relationships from Insights → Graph Explorer.

Graph Explorer

Export your vulnerabilities, assets, seeds, and technologies as CSV or JSON, or generate formatted PDF risk reports.

Reporting and Exports

Ask Aurelius whether scanning seen on your infrastructure came from Guard, checked against Guard's scan records.

Scan Attribution

Ask Marcus about your attack surface from Insights → AI Assistant.

AI Assistant

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

Add IP addresses and CIDR ranges as discovery seeds from the CIDR Ranges tab and review their ISP and country details.

Add domains as discovery seeds, review their WHOIS registrant and registrar details, and filter them by status, tag, or country.

Domains

Add full application URLs as web application seeds so Guard can test them, then review each app from its seed drawer.

Web Applications

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

Add login credentials to a web application seed so Guard scans it signed in, by AI sign-in, existing token, or manual login flow.

Authenticated Scanning for Web Applications

Assets

Assets are the foundation of your attack surface in Guard, representing everything externally discoverable that belongs to your organization.

Triage captured web application screenshots from Assets → Screenshots.

Screenshots

Technologies

Browse detected products and versions on the Technologies page.

Vulnerabilities

How to triage, track, and resolve security vulnerabilities Guard discovers across your attack surface.

How to browse, filter, preview, and launch Nuclei templates from the Signatures catalog on the Vulnerabilities page.

Signatures Catalog

How Guard alerts you when a new high-risk CVE is scanned for, found in your environment, and proven exploitable.

Emergent-Threat CVE Automation

Find exploited vulnerabilities with the CISA KEV and EPSS filters, and read exploitation details in the vulnerability drawer.

Exploits

Threats

Search a CVE to see its EPSS and CVSS scores, CISA KEV status, exploit timeline, threat actors, and ATT&CK techniques.

Run the Critical Advisories saved queries in Query Builder to find CVE-related vulnerabilities, and turn on advisory emails.

Advisories

View data from your connected threat intelligence platforms on Threats → Threat Intelligence.

Intel Sources

Attacks

Attach a custom tag when you launch a hunt so every finding it files can be filtered, tracked, and reported on separately.

Per-Hunt Custom Finding Tags

How to explore, navigate, and export Attack Path diagrams and narratives in Praetorian Guard.

Attack Paths

Attacks → C2 Bridge: connect a bridge to view Sliver, Mythic, and other C2 sessions, beacons, and hosts in one place.

C2 Bridge

Browse, filter, and run Guard capabilities from the Attacks → Capabilities tab.

Capabilities

Check out and manage parked domains used for phishing and red-team sending from Attacks → Domain Parking.

Domain Parking

Attacks → Juicy Fruit: review the open-source repository vulnerabilities Guard discovered from public OSINT sources.

Juicy Fruit

Attacks → Payload Generator: build a signed MSI installer from your shellcode for authorized assessments.

Payload Generator

Build and manage phishing campaigns from Attacks → Phishing.

Phishing

View and manage team-server instances from Attacks → Team Servers.

Team Servers

Enumerate people and probe account-existence oracles from Attacks → Phishing → Target OSINT.

Target OSINT

Detections

Create and monitor Knossos deception environments from Detections → Decoys.

Decoys

How new detection templates are automatically tested against a live affected target before they can merge and ship.

Nuclei Template Validation Pipeline

How to use the Detections page in Guard, including BAS results, gap analysis, and Automatic Findings Validation settings.

Find undefended ATT&CK techniques from Detections → Gap Analysis.

Gap Analysis

Create and watch detection sessions from Detections → Sessions.

Sessions

Read Security Posture Score and coverage from Detections → Overview.

Overview

Connect third-party security tools, cloud providers, and IT services to Guard

Integrations

Security ratings platforms that score your external security posture

Security Ratings

How Guard's integration categories are organized and how to open an integration card to connect a tool.

Integrations Overview

Knowledge Bases

Application Security Posture Management

Application Security Testing (AST)

Breach Attack Simulation

Bug Bounty

Cloud

Cloud Security Posture Management

Content Delivery Solutions

Cyber Asset Attack Surface Management

Endpoint Detection Response

Firewalls

Identity and Access Management

Integrate with popular ITSM solutions such as ADO, Freshdesk, Freshservice, and JIRA

IT Service Management (ITSM)

Mobile Device Management

Managed DNS Providers

Passive DNS Providers

SaaS Security

Secure Code Scanning

Security Information and Event Management (SIEM)

Integrate with popular source code managers such as ADO, Bitbucket, Github, and Github

Source Code Managers

Integrate with popular vulnerability scanning tools such as Qualys, Tenable, and Rapid7

Vulnerability Management (VM)

Workplace Messaging

Connect your security tools, cloud providers, and services to Guard, and check each integration's health on the Integrations page.

How Guard notifies admin users of expired or invalid integration credentials at sign-in and how to resolve the prompt.

Integration Credential Alert Modal

Deliver Guard findings into your ticketing and IT service management tools, and find the full integration catalog.

Integrations & Ticketing

Endpoints

How to install, enroll, and manage Aegis V2 endpoints from the web UI and the CLI.

Aegis V2 Installation

The Endpoints page: Aegis inventory, enrollment, and health.

Jobs

Monitor running and completed jobs through the Jobs page and the Activity Hub in the top navigation bar.