AI Agents & Toolkit
Cyrion AI does not run a fixed checklist. A team of agents reasons about your target, picks tools, and adapts to what it learns.
Cyrion AI does not run a fixed checklist. A team of agents reasons about your target, picks tools, and adapts to what it learns.
How the agents work together
- Coordinator — plans the assessment, studies the target and creates specialist agents for each area worth testing.
- Specialist agents — focused on a vulnerability class or asset, such as authentication, injection, APIs or mobile storage. They run in parallel.
- Shared discoveries — agents pass credentials, endpoints and weaknesses to each other, which is how multi-step attack chains emerge.
- Validation — findings are proven before they are reported. See Findings & Validation.
The number of agents depends on your scan mode, from 2–3 on Quick to 10+ on Thorough.
Watch them work
- Live activity feed — every agent message, tool run and result as it happens.
- Agents view — the full agent tree for a scan. Open an agent to read its reasoning, message it or stop it.
- Live browser view — see what the agents see when they drive a browser.
- Taskboard — remediation tasks created from findings.
Attack chains
The Attack Chain view shows how individual weaknesses link into a path an attacker could follow, from reconnaissance through vulnerability discovery to impact. It is the fastest way to explain real-world risk to a stakeholder, and to decide which fix breaks the most chains.
The toolkit
Agents choose from 60+ security tools, all pre-installed in an isolated environment for every scan.
| Area | Tools |
|---|---|
| Recon and discovery | Nmap, Masscan, Naabu, Subfinder, Amass, httpx, Katana, gau, Wayback URLs |
| Web vulnerability scanning | Nuclei, Nikto, Wapiti, Feroxbuster, ffuf, Gobuster, Dirsearch |
| Injection and exploitation | SQLMap, Ghauri, Dalfox, XSStrike, SSRFmap, jwt_tool, Arjun |
| Traffic analysis | Caido proxy, Interactsh for out-of-band testing, browser automation |
| JavaScript analysis | LinkFinder, SecretFinder and static JavaScript auditing |
| Mobile | jadx, apktool, Androguard, MobSF scan, Frida, Objection |
| Cloud | ScoutSuite, Prowler, S3Scanner, Trivy |
| Code and secrets | Semgrep, Bandit, TruffleHog, Trivy |
| Reverse engineering | radare2 |
Agents also write and run their own Python to build custom exploits and validate results.
Knowledge sources
- Built-in security playbooks — agents draw on a library of testing techniques for each vulnerability class.
- Threat intelligence — connect intelligence sources, such as NVD, EPSS, CISA KEV, MITRE ATT&CK and Shodan, through MCP servers.
- Agent memory — agents build a knowledge graph across a scan so later steps build on earlier ones.
Scope and safety
Agents operate inside the scope you declare. They honor your rules of engagement, avoid patterns and request-rate limits, and every scan runs in an isolated, per-scan environment. Credentials you store in the Secrets Vault are referenced by ID and are never written into scan configuration.