Account settings for AI, scanning, notifications, organization, users, access logs, monitoring, subscription, and SCIM.

Settings

Settings → SCIM: IdP connection, provisioning, and group role mapping.

SCIM

SCIM Base URL, OAuth token URL, and API-key credentials on Settings → SCIM.

IdP Configuration

SCIM-managed toggle, default role, and identity claim on Settings → SCIM.

Provisioning Settings

Settings → SCIM: give each group your identity provider pushes a Guard role, with the highest role winning.

Group Role Mapping

Settings → Subscription: current plan, coverage, and available tiers.

Subscription

What this account's plan covers, from Settings → Subscription.

Current Subscription

Settings → Subscription: compare the product modules included in each Guard tier, with your current plan marked.

Available Subscription Tiers

Settings → Users: authorized users, invitations, collaborators, and RBAC.

Users

Settings → Users: invite people to your account by email, choose their role, and remove access when needed.

Authorized Users

Organizations that invited you to view their account, from Settings → Users.

Collaborating With

What the Admin, Analyst, and Read Only roles can do, how admins assign them, and how SSO roles apply.

Role-Based Access Controls (RBAC)

Settings → Organization: profile, SSO, compliance frameworks, and deception.

Organization

How to set the organization name and logo on Settings → Organization.

Organization Profile

Settings → Organization: connect your identity provider for single sign-on and require SSO for every sign-in.

Single Sign-On

How to enable compliance framework mappings on Settings → Organization.

Security Frameworks and Standards

Settings → Organization: see whether Knossos canary decoy environments are turned on for your account.

Deception Environments

Set up Okta single sign-on for Guard: create the app, verify your domain, and map roles to Guard access.

Okta SSO Configuration

Set up Entra ID (Azure) single sign-on for Guard: register the app, verify your domain, and enter its details.

Azure SSO Configuration

Set up PingOne single sign-on for Guard: create the app, verify your domain, and enter its client details.

PingID SSO Configuration

Add the DNS TXT record Guard checks to prove you own a domain before it turns on SSO.

SSO Domain Verification

Settings → AI: feature flags, spend, providers, automatic penetration tests, and automatic findings validation.

How AI Inference, AI Agents, AI Autonomy, and AI Training relate, who can change them, and what each flag actually gates.

AI Feature Toggles

Read-only AI spend from subscription start to today, and how it differs from the monthly cap.

Total AI Spend

How the monthly AI budget cap works, who can change it, and what happens if you lower it below category allocations.

Monthly AI Spend

How monthly AI spend is split across Hannibal, Marcus, Constantine, Cato, and H1 Triage, and what a 0% slice does to automation.

Category Allocation

The dollar ceiling on a single AI-powered capability scan (for example Constantine), and how it differs from the monthly cap.

Per-scan AI Budget

How Guard picks a model from a capability tier, what disabling a vendor actually does, and the flagship-provider rule.

AI Model Providers

How scheduled Hannibal hunts run from Settings → AI, what hunt profiles add, and when the card pauses or locks.

Automatic Penetration Tests

How Cato auto-triage selects findings by source and severity, why empty selections cannot be enabled, and when validation pauses.

Automatic Findings Validation

Settings → Scanning: status, header, level, source IP, host pins, schedule, and intensity.

Scanning

Pause and resume automatic scans from Settings → Scanning without cancelling work already in flight.

Scan Status

The Chariot HTTP header and chariot- User-Agent Guard puts on scan traffic so you can allowlist it, plus the OOB callback host.

Scan Header

Settings → Scanning: see the extra HTTP headers your Praetorian team adds to Guard scan traffic.

Custom Scan Headers

The default depth applied to every asset: passive enumeration, active enumeration, or vulnerability discovery.

Scan Level

Whether Guard scans from a rotating pool or from the static 66.45.78.0/24 range, and who can switch modes.

Source IP Addresses

Pin a hostname to a specific IP for Guard's scanner when public DNS does not match how the host should be reached.

Pin Host to IP

See how often Guard re-scans your assets and the optional launch window, which only super-admins can change.

Scan Schedule

Account-wide simultaneous hosts and requests-per-host, plus optional per-asset override profiles.

Scan Intensity

Settings → Notifications: email, outbound webhooks, chat, ITSM, exposure alerts, inbound webhook, and scheduled reports.

Notifications

How to add inbox destinations and set a severity threshold on Settings → Notifications.

Email Notifications

How Guard POSTs open-risk notifications to your endpoint from Settings → Notifications.

Outbound Webhooks

How Slack, Microsoft Teams, Google Chat, and Zulip alert destinations are added from Settings → Notifications.

Chat Messaging

How Jira Cloud and ServiceNow ticketing destinations are added from Settings → Notifications.

IT Service Management

How to choose which risk exposures and port categories notify you, from Settings → Notifications.

Exposure Alerts

How to generate the URL that ingests objects into Guard from Settings → Notifications.

Inbound Webhook

How to turn on periodic security health report email from Settings → Notifications.

Scheduled Reports

Settings → Access Logs: see who signed in to your account, when, and whether they used SSO or a password.

Access Logs

Asset counts from the last scan, from Settings → Monitoring.

Monitoring

What Guard is and how to get started with your first seeds, the onboarding wizard, and your dashboard.

Welcome to Praetorian Guard

An overview of Guard's five modules, from attack surface management to breach and attack simulation, and its attack agents.

What is Praetorian Guard?

How Guard maps and scores risk across external, internal, cloud, application, code, and LLM attack surfaces.

Attack Surfaces

How Guard discovers your web applications and APIs, maps their authentication, and tests them for security vulnerabilities.

Application Attack Surface

How Guard scans your CI/CD pipelines across GitHub, GitLab, Azure DevOps, and Jenkins for supply-chain risks.

CICD Pipeline Surface

How Guard connects to your cloud accounts to inventory resources and find public exposures, secrets, and misconfigurations.

Cloud Attack Surface

How Guard discovers and tests everything your organization exposes to the public internet, starting from your seeds.

External Attack Surface

How Guard assesses your Active Directory and tests internal network services for weak credentials.

Internal Attack Surface

How Guard finds the LLM and AI services in your environment and tests them for prompt injection and related risks.

LLM Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface

How Guard discovers your repositories and scans them for vulnerabilities, exposed secrets, and pipeline weaknesses.

Source Code Surface

How Guard finds breach-exposed employee email addresses on your domains and flags domains open to email spoofing.

User Attack Surface

What each Guard module covers, from attack surface and vulnerability management to pentesting and red teaming.

Platform Modules

How Guard expands your seeds into discovered assets, suggests new seeds for approval, and tracks each asset's status.

Attack Surface Management (ASM)

How Guard scores each simulated MITRE ATT&CK technique from Prevented to Undetected and rolls them into a posture score.

Breach & Attack Simulation (BAS)

How Guard enriches CVE findings with CVSS, CISA KEV, EPSS, MITRE ATT&CK techniques, and CWE weaknesses.

Cyber Threat Intelligence (CTI)

How Guard runs offensive agents like Julius, Hadrian, Trajan, and Brutus, and has Praetorian operators validate findings.

Penetration Testing & Application Security

The Ludacris-only product module: a counted red-team engagement per year, run by Praetorian — not a customer self-serve Attacks tab.

Red Teaming

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

Unified Vulnerability Management

Praetorian's Roman-named capabilities that Guard runs, such as Brutus, Julius, Titus and Trajan, many of them open source, plus Knossos deception environments.

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Vulnerability Scanner

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 43+ protocols, a cumulative credential corpus for cross-service reuse testing, account enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, repository security review workflow, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian is a security testing framework for REST, GraphQL, and gRPC APIs that tests for OWASP API vulnerabilities using role-based authorization testing and YAML-driven templates.

Hadrian: API Security Testing

How Julius, Praetorian's open-source tool, identifies the LLM serving software, such as Ollama or vLLM, behind an endpoint.

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

How Pius, the open-source tool behind Guard's asset discovery, maps your domains, subdomains, and IP ranges.

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula scans software supply chains for known vulnerabilities, malicious packages, compromised AMIs, and IaC image references across 7 ecosystems and 12 manifest formats, integrated natively into Guard.

Caligula: Software Supply Chain Security Scanner

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Knossos procedurally generates realistic decoy cloud environments so attackers waste time in fake infrastructure instead of yours.

Knossos: Deception Environments

Sign up for Guard, set up multi-factor authentication, and manage your user profile.

Getting Started with Praetorian Guard Platform

Ask Marcus about your attack surface, and use metrics, benchmarks, Query Builder, Graph Explorer, and reports.

Insights

How Guard turns your open, validated internet-facing risks into the A–F grade and 0–100 score on the Metrics page.

How Your Internet Perimeter Score and Grade Are Calculated

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Insights → Metrics: track vulnerabilities, assets, and remediation trends across customizable dashboard widgets.

Metrics

Insights → Benchmarks: see your coverage across MITRE ATT&CK, D3FEND, EMB3D, NIST CSF, and FDA Premarket.

Benchmarks

Insights → Query Builder: build, run, and save graph queries across your assets, risks, ports, and cloud resources.

Query Builder

Explore entity relationships from Insights → Graph Explorer.

Graph Explorer

Export your vulnerabilities, assets, seeds, and technologies as CSV or JSON, or generate formatted PDF risk reports.

Reporting and Exports

Ask Aurelius whether scanning seen on your infrastructure came from Guard, checked against Guard's scan records.

Scan Attribution

Ask Marcus about your attack surface from Insights → AI Assistant.

AI Assistant

Add domain, CIDR range, and web application seeds, set up authenticated scanning, and trace how domains were found.

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

Add IP addresses and CIDR ranges as discovery seeds from the CIDR Ranges tab and review their ISP and country details.

Add domains as discovery seeds, review their WHOIS registrant and registrar details, and filter them by status, tag, or country.

Domains

Add full application URLs as web application seeds so Guard can test them, then review each app from its seed drawer.

Web Applications

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

Add login credentials to a web application seed so Guard scans it signed in, by AI sign-in, existing token, or manual login flow.

Authenticated Scanning for Web Applications

Review screenshots Guard captures of discovered web applications in Contact Sheet or Triage Inbox view on Assets → Screenshots.