Settings

Settings → SCIM: IdP connection, provisioning, and group role mapping.

SCIM

SCIM Base URL, OAuth token URL, and API-key credentials on Settings → SCIM.

IdP Configuration

SCIM-managed toggle, default role, and identity claim on Settings → SCIM.

Provisioning Settings

Map IdP SCIM groups to Guard roles on Settings → SCIM.

Group Role Mapping

Settings → Subscription: current plan, coverage, and available tiers.

Subscription

What this account's plan covers, from Settings → Subscription.

Current Subscription

The Product Modules matrix on Settings → Subscription.

Available Subscription Tiers

Settings → Users: authorized users, invitations, collaborators, and RBAC.

Users

How to invite and remove people on Settings → Users.

Authorized Users

Organizations that invited you to view their account, from Settings → Users.

Collaborating With

Settings → Organization: profile, SSO, compliance frameworks, and deception.

Organization

How to set the organization name and logo on Settings → Organization.

Organization Profile

How to add an SSO provider from Settings → Organization.

Single Sign-On

How to enable compliance framework mappings on Settings → Organization.

Security Frameworks and Standards

The Knossos decoy toggle on Settings → Organization — customers see it; Praetorian turns it on.

Deception Environments

Okta SSO Configuration

Azure SSO Configuration

PingID SSO Configuration

SSO Domain Verification

Settings → AI: feature flags, spend, providers, automatic penetration tests, and automatic findings validation.

How AI Inference, AI Agents, AI Autonomy, and AI Training relate, who can change them, and what each flag actually gates.

AI Feature Toggles

Read-only AI spend from subscription start to today, and how it differs from the monthly cap.

Total AI Spend

How the monthly AI budget cap works, who can change it, and what happens if you lower it below category allocations.

Monthly AI Spend

How monthly AI spend is split across Hannibal, Marcus, Constantine, Cato, and H1 Triage, and what a 0% slice does to automation.

Category Allocation

The dollar ceiling on a single AI-powered capability scan (for example Constantine), and how it differs from the monthly cap.

Per-scan AI Budget

How Guard picks a model from a capability tier, what disabling a vendor actually does, and the flagship-provider rule.

AI Model Providers

How scheduled Hannibal hunts run from Settings → AI, what hunt profiles add, and when the card pauses or locks.

Automatic Penetration Tests

How Cato auto-triage selects findings by source and severity, why empty selections cannot be enabled, and when validation pauses.

Automatic Findings Validation

Settings → Scanning: status, header, level, source IP, host pins, schedule, and intensity.

Scanning

Pause and resume automatic scans from Settings → Scanning without cancelling work already in flight.

Scan Status

The Chariot HTTP header and chariot- User-Agent Guard puts on scan traffic so you can allowlist it, plus the OOB callback host.

Scan Header

Optional extra HTTP headers on scan traffic. Visible to the tenant; only Praetorian can edit.

Custom Scan Headers

The default depth applied to every asset: passive enumeration, active enumeration, or vulnerability discovery.

Scan Level

Whether Guard scans from a rotating pool or from the static 66.45.78.0/24 range, and who can switch modes.

Source IP Addresses

Pin a hostname to a specific IP for Guard's scanner when public DNS does not match how the host should be reached.

Pin Host to IP

How often Guard re-scans (cadence) and the optional UTC launch window. Super-admin only.

Scan Schedule

Account-wide simultaneous hosts and requests-per-host, plus optional per-asset override profiles.

Scan Intensity

Settings → Notifications: email, outbound webhooks, chat, ITSM, exposure alerts, inbound webhook, and scheduled reports.

Notifications

How to add inbox destinations and set a severity threshold on Settings → Notifications.

Email Notifications

How Guard POSTs open-risk notifications to your endpoint from Settings → Notifications.

Outbound Webhooks

How Slack, Microsoft Teams, Google Chat, and Zulip alert destinations are added from Settings → Notifications.

Chat Messaging

How Jira Cloud and ServiceNow ticketing destinations are added from Settings → Notifications.

IT Service Management

How to choose which risk exposures and port categories notify you, from Settings → Notifications.

Exposure Alerts

How to generate the URL that ingests objects into Guard from Settings → Notifications.

Inbound Webhook

How to turn on periodic security health report email from Settings → Notifications.

Scheduled Reports

Who signed in to this account, from Settings → Access Logs.

Access Logs

Asset counts from the last scan, from Settings → Monitoring.

Monitoring

Get started with the Praetorian Guard Platform — your AI-powered offensive security platform

Welcome to Praetorian Guard

What is Praetorian Guard?

Quantifying enterprise risk requires examination of all the angles

Attack Surfaces

Application Attack Surface

CICD Pipeline Surface

Cloud Attack Surface

External Attack Surface

Internal Attack Surface

LLM Attack Surface

Upload an Android APK and let Guard decompile it, analyze its manifest, and file findings alongside the rest of your attack surface.

Mobile Attack Surface

Source Code Surface

User Attack Surface

Understand the core modules of Praetorian Guard: Continuous Offensive Security, Attack Surface Management, Vulnerability Management, and Breach & Attack Simulation

Platform Modules

Attack Surface Management (ASM)

Breach & Attack Simulation (BAS)

Cyber Threat Intelligence (CTI)

Penetration Testing & Application Security

The Ludacris-only product module: a counted red-team engagement per year, run by Praetorian — not a customer self-serve Attacks tab.

Red Teaming

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

Unified Vulnerability Management

Praetorian's open-source Caesar-named capabilities integrated into Guard

The Caesars

Augustus is an LLM vulnerability scanner that tests AI systems for jailbreaks, prompt injection, MCP server security, and other attack techniques across a broad range of model providers.

Augustus: LLM Jail Breaking

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Aurelian: Multi-Cloud Security Reconnaissance

Brutus is a credential testing capability in the Praetorian Guard Platform supporting 23+ protocols, username enumeration with named results, and seamless pipeline integration.

Brutus: Modern Credential Attack Testing

How to use Constantine's autonomous vulnerability discovery and patching engine, and its code repository security analysis capability — including CVE benchmark coverage, LLM-driven entrypoint discovery, the agentic threat-hunting agent, proof-of-exploitation lifecycle tabs, build caching, and scored repository findings via the CLI and MCP server.

Constantine: Locates Fatal Security Bugs in Software & Code Repository Security Analysis

Hadrian: API Security Testing

Julius: LLM Service Fingerprinting

Nerva is Guard's network fingerprinting engine — identifying services, extracting versions, and correlating CVEs across your attack surface.

Nerva: Service Fingerprinting

Pius: Attack Surface Mapping

Titus is Praetorian Guard's purpose-built secret scanner, providing automated continuous secret discovery, validation, and on-demand credential analysis across your attack surface.

Titus: Secrets Discovery

Trajan scans GitHub Actions, GitLab CI/CD, and Azure DevOps pipelines for supply-chain and CI/CD security risks, surfacing misconfigurations, excessive permissions, and exploitable vulnerabilities — and can now run as a native GitHub Action with verification chains for confirmed findings.

Trajan: CI/CD Pipeline Attacks

Vespasian discovers API endpoints from captured traffic and generates REST, GraphQL, SOAP, and WebSocket specifications, including SPA endpoints recovered via JS static analysis in fully offline capture-once/generate-many workflows.

Vespasian: API Discovery and Specification Generation

Caligula: Software Supply Chain Security Scanner

Automated tier-one web application vulnerability discovery powered by the Probus adapter, with API fuzzing findings surfaced in Guard.

Probus Web Application Attack Surface

Knossos procedurally generates realistic decoy cloud environments so attackers waste time in fake infrastructure instead of yours.

Knossos: Deception Environments

Learn the basics of interacting with Praetorian Guard Platform

Getting Started with Praetorian Guard Platform

Insights

How the A–F letter grade and 0–100 Internet Perimeter Score on Insights → Metrics are calculated, what risks count, and when the score updates.

How Your Internet Perimeter Score and Grade Are Calculated

How to use Marcus, Guard's AI assistant, and what to expect from its performance on large, complex workflows.

Marcus AI Assistant

Overview of the Insights page, including AI Assistant, Metrics, Benchmarks, Query Builder, and Graph Explorer.

Read account metrics from Insights → Metrics.

Metrics

Compare your posture on Insights → Benchmarks.

Benchmarks

Build custom queries from Insights → Query Builder.

Query Builder

Explore entity relationships from Insights → Graph Explorer.

Graph Explorer

Overview of reporting and export functionality in the Praetorian Guard Platform

Reporting and Exports

How to use the Aurelius scan attribution skill to confirm whether scanning activity observed on your infrastructure originated from the Guard platform.

Scan Attribution

Ask Marcus about your attack surface from Insights → AI Assistant.

AI Assistant

Seeds

How to define, manage, and triage seeds on the Seeds page in the Praetorian Guard Platform.

Manage IP and CIDR seeds from Seeds → IPs.

Manage domain seeds from Seeds → Domains.

Domains

Manage web application seeds from Seeds → Web Applications.

Web Applications

View the full discovery provenance tree for any domain asset to understand exactly how and why it appears in your attack surface.

Asset Discovery Provenance Tree

How to configure authenticated scanning for each Web Application seed using Automated Authentication, Use Existing Token, or Manual Login Flow.

Authenticated Scanning for Web Applications

Assets

Assets are the foundation of your attack surface in Guard, representing everything externally discoverable that belongs to your organization.

Triage captured web application screenshots from Assets → Screenshots.

Screenshots

Technologies

Browse detected products and versions on the Technologies page.

Vulnerabilities

How to triage, track, and resolve security vulnerabilities Guard discovers across your attack surface.

How to browse, filter, preview, and launch Nuclei templates from the Signatures catalog on the Vulnerabilities page.

Signatures Catalog

How Guard automatically scans for high-severity CVEs, detects them in your environment, launches exploitation hunts, and delivers a three-stage notification sequence.

Emergent-Threat CVE Automation

Review exploit-verified findings from Vulnerabilities → Exploits.

Exploits

Threats

Threat Intelligence

Read threat advisories from Threats → Advisories.

Advisories

See which intelligence sources feed Threats → Intel Sources.

Intel Sources

Attacks

How to attach a custom tag when launching a Hannibal hunt so that every finding from that hunt can be filtered, tracked, and reported on independently.

Per-Hunt Custom Finding Tags

How to explore, navigate, and export Attack Path diagrams and narratives in Praetorian Guard.

Attack Paths

Connect and operate C2 from Attacks → C2 Bridge.