Key Takeaways
- CyberSentinel AI v3.0 is an open‑source, locally‑run platform that fuses 33 real‑world penetration‑testing and threat‑intelligence tools with an agentic AI engine.
- It operates inside isolated Docker containers (Kali Linux for scans, plus six auxiliary services) and requires no cloud connectivity.
- The AI can autonomously select, execute up to five tools concurrently, and synthesize a unified analysis in real time.
- Users can switch mid‑conversation between Claude, GPT‑4o, OpenRouter, or a fully offline Ollama model without losing context.
- Knowledge is stored in Neo4j (attack‑surface graph), ChromaDB (RAG backed by MITRE, CIS, NIST), and an ELK Stack SIEM for log analysis.
- The toolset is organized into six functional categories covering live scanners, threat‑intel APIs, SIEM connectors, AI detection, threat hunting, and compliance frameworks.
- Built‑in safeguards block prompt injection, SSRF, and system‑prompt leakage; scans are limited to authorized targets only.
- Minimum hardware: Docker Desktop and 8 GB RAM; initial image pull ≈ 4–5 GB, subsequent startups ~30 seconds.
- The project marks a step toward practical, self‑contained security automation for researchers and red teams.
Overview and Core Concept
CyberSentinel AI v3.0 introduces a novel approach to autonomous security tooling by embedding a provider‑agnostic AI engine directly with a curated suite of 33 real‑world penetration‑testing and threat‑intelligence utilities. Unlike typical AI security assistants that merely suggest commands, this platform actually executes tools such as Nmap, SQLMap, Nikto, Nuclei, and OWASP ZAP inside an isolated Kali Linux Docker sandbox. The AI then interprets the raw output in real time, delivering actionable insights without requiring the user to manually run each utility. This tight integration of language‑model reasoning with live offensive security tools positions CyberSentinel as a bridge between conversational AI and hands‑on red‑team workflows.
Architecture and Deployment
The platform is delivered as a set of seven containerized services orchestrated via Docker Compose, ensuring that all components run locally on the user’s machine. At the core is a Kali Linux container that hosts the security scanners, keeping potentially hazardous operations fully sequestered from the host operating system. Supporting this are containers for the frontend, backend, knowledge graph, vector database, and SIEM stack. By leveraging Docker, CyberSentinel avoids complex installation procedures; users simply clone the GitHub repository, run docker compose up, and the entire environment spins up with consistent dependencies across Linux, macOS, and Windows systems equipped with Docker Desktop.
Frontend and Backend Services
User interaction occurs through a Next.js‑based web interface served on port 3000, which provides a streaming chat experience reminiscent of modern LLM frontends. The interface forwards user prompts to a FastAPI backend listening on port 8000; this layer handles intent classification, orchestrates tool selection, routes requests to the appropriate AI model, and aggregates results from the scanning containers. The backend also manages conversation state, enabling seamless mid‑conversation switches between different AI providers while preserving context. Together, the frontend‑backend pair creates a responsive, interactive security analyst that can explain its reasoning, show intermediate tool outputs, and present consolidated reports.
Data Infrastructure
CyberSentinel augments its language model with three specialized data stores. A Neo4j graph database maintains a dynamic knowledge graph of assets, vulnerabilities, and MITRE ATT&CK techniques, allowing the AI to reason about attack surfaces in a relational manner. ChromaDB serves as a Retrieval‑Augmented Generation (RAG) engine, populated with embeddings from MITRE, CIS, and NIST frameworks so that the model can pull relevant guidance or compliance checks on demand. Finally, an ELK Stack (Elasticsearch, Logstash, Kibana) operates as a SIEM, pre‑seeded with sample security events to train the AI’s log‑analysis capabilities and to provide a familiar interface for reviewing scan outputs and alerts. This triad of storage systems equips the agent with both structured knowledge and unstructured event data for sophisticated reasoning.
Agentic Execution Model and Tool Orchestration
At the heart of CyberSentinel lies an agentic execution loop: the AI first classifies the user’s intent (e.g., “enumerate subdomains,” “check for SQL injection,” “assess compliance with PCI‑DSS”). Based on this classification, it autonomously selects the most appropriate tools from its arsenal, launching up to five scans in parallel to maximize efficiency. As each tool completes, the AI streams its output back to the user while simultaneously feeding results into its internal reasoning module. Once all selected tools have finished, the agent synthesizes a unified analysis that correlates findings, highlights critical risks, and suggests remediation steps. This capability moves beyond simple suggestion‑based assistants toward true end‑to‑end automation of reconnaissance and vulnerability assessment cycles.
Toolset Categories
The platform’s 33 utilities are grouped into six functional domains to aid both the AI’s selection logic and the user’s understanding. Live Scanners (11 items) include Nmap, Nikto, Nuclei, SQLMap, Subfinder, OWASP ZAP, SSL/TLS analyzers, DNS reconnaissance, WHOIS, HTTP header inspectors, and ping/traceroute utilities. Threat Intel APIs (5) provide live data from Shodan, VirusTotal, AbuseIPDB, AlienVault OTX, and the NVD/CISA Known Exploited Vulnerabilities catalog. SIEM Integration (3) offers connectors for the ELK Stack, Splunk, and Wazuh, enabling bidirectional data flow. AI Detection (5) comprises Zeek‑based traffic analysis, IOC extraction, log‑analysis modules, threat‑detection heuristics, and an email‑phishing analyzer. Threat Hunting (4) supplies YARA rule execution, Sigma rule processing, Snort/Suricata rule management, and a SIEM query generator for proactive hunting. Finally, Compliance (5) embeds checks against MITRE ATT&CK, MITRE ATLAS, NIST/CIS baselines, HIPAA/PCI‑DSS requirements, and SOC 2/FedRAMP frameworks, allowing the AI to map findings directly to regulatory obligations.
AI Provider Switching and Offline Capability
A distinctive feature of CyberSentinel is its ability to swap the underlying language model during a conversation without losing conversational state. Users can choose among Anthropic’s Claude, OpenAI’s GPT‑4o, OpenRouter (which aggregates over 100 models), or a fully local Ollama instance running the qwen2.5:7b model. All API keys are optional; if none are supplied, the platform defaults to Ollama, enabling completely offline operation. This flexibility lets users balance performance, cost, and privacy preferences while maintaining a continuous analytical thread—critical for long‑running assessments where shifting contexts (e.g., moving from network scanning to web‑app testing) must retain memory of earlier findings.
Threat Intelligence Integration and Updates
To keep vulnerability context current, CyberSentinel continuously pulls live threat‑intelligence feeds from the NVD, CISA KEV, EPSS, AlienVault OTX, and Abuse.ch. These sources enrich scan results with up‑to‑date CVE scores, exploit availability, and threat‑actor attribution, ensuring that the AI’s analysis reflects the latest threat landscape. Because the data is fetched at runtime, there is no need for manual signature updates; the platform’s RAG layer can instantly incorporate newly disclosed vulnerabilities into its reasoning process, providing a significant advantage over static toolsets that rely on periodic database refreshes.
Security Safeguards and Legal Compliance
Recognizing the power of autonomous scanning, CyberSentinel embeds several protective mechanisms. Input and output guardrails are enforced to mitigate prompt injection, SSRF attempts, and inadvertent leakage of system prompts. All scanning activity is confined to the isolated Kali container, preventing any direct interaction with the host filesystem or network interfaces. The project’s documentation explicitly cautions users that conducting scans against systems without explicit authorization violates the Computer Fraud and Abuse Act (CFAA) and similar statutes. It recommends safe, publicly available targets such as scanme.nmap.org and testphp.vulnweb.com for experimentation and learning, reinforcing responsible use while still offering a realistic sandbox for skill development.
System Requirements, Performance, and Significance
To run CyberSentinel AI v3.0, users need Docker Desktop and a minimum of 8 GB of RAM; the initial docker compose up pulls roughly 4–5 GB of container images and model data. Subsequent startups are rapid, typically completing in about 30 seconds as layers are cached and the Ollama model is loaded into memory. The platform’s blend of agentic AI, real‑world tool execution, and robust local data stores represents a meaningful step toward self‑contained security automation. By eliminating reliance on cloud‑based APIs and offering a fully auditable, offline‑capable environment, CyberSentinel empowers red teams, penetration testers, and security researchers to conduct sophisticated assessments with greater control over data privacy, operational costs, and compliance posture—all while remaining grounded in the latest offensive‑security techniques and threat‑intelligence feeds.