Questions before your first AutoAttack campaign.

AutoAttack is an autonomous red team agent. It pursues your goal at machine speed. It chains real attacks and uses newly gained credentials and footholds to advance toward that goal. Deploy its campaign container on a dedicated Linux host with access to the systems in scope.

A hop records an action and its outputs. For example, the agent might recover a password and then use it to gain administrator access. The report connects access gains that advance your objective to the steps that enabled them.

AutoAttack runs an autonomous attack campaign toward the goal you set, within your authorized scope. A human engagement can complement it with social engineering, physical access or a signed assessor's attestation.

Set the objective, authorized scope, exclusions and starting access before deployment. Review the reversible changes included in the campaign setup. Credential attempts use lockout controls. Each campaign runs in a fresh container, and you can request a stop from the campaign page.

Create an account and a campaign, then run the provided command on a dedicated Linux host with rootful Docker and access to the target network. The campaign begins when the agent connects. You do not need to install a persistent agent on each target.

You can run a complete campaign for free and read its attack narrative, including technique and weakness labels. Targets have anonymous labels that stay consistent within the campaign. A subscription reveals their names, captured evidence and remediation advice.

The report follows access gains that advance your goal and the steps that enabled them. Each step connects the access it used to the result it produced, with captured evidence and recommended fixes available to subscribers.

The report is one causal narrative with captured evidence and fixes beside its steps. It distinguishes an objective reached from one left open.

The network, starting access, permitted actions and available paths determine campaign timing. Our benchmark publishes results from a deliberately vulnerable Active Directory lab, with the configuration and method beside the results.

The benchmark separates tests we ran from results published by another vendor. The Nessus comparison used the same lab snapshot and network position for both tools. The NodeZero comparison uses Horizon3's published result and our separate runs on a lab configured from its description. Read the individual writeups for settings, dates and results.

Pricing is graduated per discovered host, billed annually: $49 per host for 1–100 hosts, $34 for 101–500, $19 for 501–2,500, and $9 for 2,501–10,000. Each rate applies only to the hosts in its band. There is no minimum, and every band includes the same product. Above 10,000 hosts, contact sales.

Our application and campaign records are hosted in France. Payment and email providers process some account data outside the EEA. Campaign objectives and selected campaign context are also sent to an external service for campaign analysis and attack planning. This context can include credential details, access evidence and operation output. See the privacy policy for processing providers, retention and international transfers.