AI-driven continuous automated penetration testing

CyriCART
Cyritex Automated Red Teaming System

CyriCART is designed for large-scale Red Teams, transforming real-world attack techniques and continuously updated threat intelligence into plannable, executable, and auditable
automated testing. It confirms whether vulnerabilities are exploitable, how far attack paths can reach, and retrieves evidence to advance and improve security efforts.

CyriCART is designed for large-scale Red Teams, transforming real-world attack techniques and continuously updated threat intelligence into plannable, executable, and auditable automated testing. It verifies whether vulnerabilities are exploitable, how far attack paths can go, and brings back evidence to drive and improve remediation efforts.

CyriCART is designed for large-scale Red Teams, transforming real-world attack techniques and continuously updated threat intelligence into plannable, executable, and auditableautomated testing. It confirms whether vulnerabilities are exploitable, how far attack paths can reach, and retrieves evidence to advance and improve security efforts.

Real-world Attack Techniques · Attack Path Exploitability · Scheduled Planning · Evidence-based Reports

Book a Product Demo

Why is continuous automated penetration testing needed?

The environment is constantly changing, and attack paths must be continuously verified.

Assets, components, permissions, and exposure surfaces are constantly changing; new attack techniques also continue to enter the risk scope. Security teams need to continuously confirm: which risks have exploitable conditions, how far an attack can reach, and at which stage key controls fail. CyriCART incorporates testing into scheduled tasks, allowing attack paths to be repeatedly verified as the environment changes and application versions are released.

Assets, components, permissions, and attack surfaces are constantly changing; new attack techniques also continue to enter the risk scope. Security teams need to continuously confirm which risks are exploitable, how far an attack can penetrate, and at which stage key controls fail. CyriCART incorporates testing into scheduled tasks, allowing attack paths to be repeatedly verified as the environment changes and application versions are released.

CyriCARTSCHEDULED ATTACK VERIFICATION

Scheduled Tasks Continuously Executing

Each run re-confirms the attack paths and exploitability based on the current environment.

How CyriCART Works

From information gathering to path evidence, execute the entire chain in one go.

CyriCART automatically organises attack modules to complete controlled testing based on the exposure surface or selected scope and current threat intelligence. Execution results and evidence are retained at each stage,
helping teams confirm whether the attack can continue to progress, as well as the exploitability of weaknesses.

Based on the attack surface or a selected scope along with current threat intelligence, CyriCART automatically organises attack modules to complete controlled testing. Execution results and evidence are retained at each stage to help teams confirm whether the attack can proceed and evaluate the exploitability of vulnerabilities.

A controlled execution that generates reviewable evidence.

The attack path progresses within the current scope, with key nodes and outcomes recorded simultaneously.

01 · RECONReconnaissance
02 · VALIDATEVulnerability validation
03 · SESSIONControlled Session
04 · PATHPath Confirmation
05 · EVIDENCEEvidence Collection
06 · REPORTProject Report

What are the testing methods for CyriCART?

Under the same system, select the test method according to task boundaries.

CyriCART provides four levels of Agents based on execution boundaries, and the final choice is jointly determined by the scope of assets, validation depth, and risk sensitivity,
with high-risk actions still left for humans to approve.

CyriCART features 16,000 built-in attack modules, covering the entire penetration testing lifecycle from external information gathering, vulnerability validation, session establishment, and lateral movement, to internal network control. The module library is continuously updated with the latest APT tactics and techniques, helping teams convert current threats into executable attack scenarios.

01NO LLM

Scanning Agent

Pure tool and playbook execution, no LLM required; used for baseline coverage, large-scale asset checks, and periodic regression.

Baseline Coverage · Periodic Regression

02ATT&CK · 5

Focused Agent

Deep validation around key attack chains, covering 5 tactical stages of MITRE ATT&CK; ideal for authentication and API security testing.

Key Chains · Authentication / API

03ATT&CK · 14

Comprehensive Agent

Parallel coverage of the complete attack lifecycle, covering 14 tactical stages of MITRE ATT&CK; ideal for full-spectrum attack surface checks.

Complete Lifecycle · Full-Spectrum Checks

04EPHEMERAL

Highly Isolated Agent

Executes exploit validation in a one-time, disposable sandbox; ideal for sensitive targets close to production environments.

Disposable Sandbox · Highly Sensitive Targets

Task Boundary InputDefine the scope before choosing the execution method.

CyriCART Core Output Results

Base risk priority on evidence of exploitability

The focus of CyriCART output is the actual result after attack execution: whether the vulnerability can be exploited, how the path is connected, which assets are affected, and
at which stage the breach occurs. Based on this, the team determines the prioritization of remediation, prioritizing resources on issues that truly impact the attack surface.

The focus of CyriCART's output is on the actual results after an attack is executed: whether vulnerabilities can be exploited, how paths are connected, which assets are affected, and where the gaps lie. Based on this, teams can determine the remediation priority, allocating resources first to matters that genuinely impact the attack surface.

CyriCART ASSESSMENT REPORT

Controlled execution completed

SUMMARY

High-priority attack paths confirmed

This result focuses on four direct questions: Can it be triggered? Can it be reached? At which segment is the defensive line broken? Where to start remediation first?

P1 REMEDIATION PRIORITY Results are ready to be used for triaging remediation responsibilities.

Exploitability established Controlled trigger successful; the path meets realistic execution conditions.

EXPLOITABLE

Critical assets reachable The access relationship between the entry point and the target has been confirmed.

REACHABLE

Clear control gaps The gap locations have been clearly identified through evidence.

CONTROL GAP

Remediation priorities provided Address exposure entry points first, followed by associated controls and path nodes.

P1 ACTION

CyriCART ATTACK PATH ASSESSMENT REPORT

受控执行完成

EXECUTIVE FINDING

高优先级攻击路径已确认

本次结果聚焦四个直接问题：能不能触发、能不能抵达、哪一段防线断开、先从哪里修复。

P1 REMEDIATION PRIORITY 结果已经可用于分派修复责任。

可利用性成立 受控触发成功，路径具备现实执行条件。

EXPLOITABLE

关键资产可达 入口与目标之间的访问关系已被确认。

REACHABLE

防线断点明确 攻击推进中的控制环节存在失效位置。

CONTROL GAP

修复优先级给出 先处理暴露口，再处理关联控制与路径节点。

P1 ACTION

Cyritex Collaborative Closed-loop

A unified attack path connecting threat intelligence, validation, and remediation.

CyriIntel provides threat clues, which CyriCART converts into exploitability confirmation. The resulting data is synchronised with CyriBAS and CyriAI,
helping the team assess the status of the defence system and proceed with the next steps of remediation.

CyriIntel provides threat leads, which CyriCART then translates into exploitability validation. The resulting data is synchronised with CyriBAS and CyriAI to help teams assess the status of their defensive posture and drive subsequent remediation.

CyriIntel provides threat clues, which CyriCART converts into exploitability confirmation. The resulting data is synchronised with CyriBAS and CyriAI, helping the team assess the status of the defence system and proceed with the next steps of remediation.

INTELLIGENCE INPUT

CyriIntel

Deconstruct intelligence files clearly first.

Once clues enter, their sources, impact scope, and confidence labels are organised first. Subsequent validation and handling will follow the exact same basis.

Source Clues can be traced back to specific threat sources and observation times.

Impact Affected assets, exposed entry points, and environmental associations are expanded together.

Judgment Conclusions, evidence, and priorities are kept in the very same file.

CyriCART VERIFICATION EVIDENCE

Organise intelligence into distributable, verifiable, and reusable evidence packages.

Attack validation confirmed

Move forward with the exact same evidence.

Validation evidence is sent first to defense lines for judgment, and then to subsequent action orchestration. The team sees a complete collaborative chain, rather than scattered fragments of conclusions.

Defense Line Judgment CyriBAS uses this evidence to verify whether current controls are genuinely effective.

Enter validation

Subsequent Action CyriAI takes the same evidence to push the next step of handling to the execution level.

Enter Action

A single file, used simultaneously for validation, judgment, and action.

FAQ

About CyriCART

Here are the questions we hear most about CyriCART — covering what it is, its attack capabilities, how testing stays controlled, and how to use the results.

Q: What is CyriCART, and how is it different from traditional penetration testing services?