One mission-level security workspace
An engagement represents a full authorized red-team or pentest effort, keeping scope, targets, tasks, evidence, and outcomes together.
Overview
AI-assisted red team work, organized from objective to report
DrowAI helps an operator run scoped security tasks with a guided agent, isolated Kali execution, structured evidence, and engagement-ready reporting in one workspace.
Workflow
How DrowAI organizes agentic security work
Focused work inside the engagement
Tasks break a larger engagement into specific objectives, so the operator and agent can work through separate lines of investigation without losing context.
Persistent security knowledge
As the agent works, DrowAI turns collected activity into durable records for assets, services, evidence, findings, relationships, and reporting.
Knowledge workspace
Every agent action becomes structured security knowledge
DrowAI keeps findings, assets, services, evidence, and network territory connected in one inspectable workspace, so an operator can move from raw activity to a defensible security picture.
Territory
Topology and relationship map
Network territory, selected asset context, and linked finding state.
Deeper work, delegated visibly
A specialized subagent runs a multi-step assessment while its reasoning, tools, and status remain inspectable beside the main task.
The agents
Meet the specialists
behind the task.
Focused expertise. A shared objective. Meet the agents that bring their own perspective to your investigation.
Network reconnaissance
Pathfinder
Every investigation starts with a way in.
Pathfinder makes the network legible. It discovers reachable hosts, identifies open ports, and enumerates services within the assigned scope, giving the investigation a clear place to begin.
- Host discovery
- Port scanning
- Service enumeration
What it brings back
Reachable hosts, open services, and the evidence behind them.
External asset discovery
Cartographer
Find the connections. See the bigger picture.
Cartographer traces an organization’s external footprint. Starting with an assigned organization or root domain, it connects domains, DNS records, certificates, and addresses to reveal related assets.
- Domain discovery
- DNS reconnaissance
- Asset attribution
What it brings back
Attributed external assets and candidates for deeper investigation.
Web reconnaissance
Webweaver
Follow the threads of an application.
Webweaver explores the shape of an assigned web application. It probes HTTP endpoints, identifies technologies, crawls links, and discovers content to give the investigation a clearer view of the application.
- HTTP probing
- Web fingerprinting
- Content discovery
What it brings back
Discovered endpoints, application technologies, and web reconnaissance evidence.
Protocol enumeration
Delver
Look deeper into what a service reveals.
Delver examines services that have already been discovered. It enumerates assigned endpoints across protocols such as SMB, SNMP, SSH, TLS, and SMTP, turning service responses into useful investigation context.
- Protocol enumeration
- Service details
- Configuration evidence
What it brings back
Protocol-level observations and evidence from the assigned services.
Web vulnerability assessment
Hunter
Turn a suspicion into a finding.
Hunter assesses already-mapped web applications for vulnerabilities. It examines assigned endpoints and inputs, checks for misconfigurations, and gathers the evidence needed to support a finding within the task’s scope.
- Vulnerability assessment
- Input testing
- Misconfiguration checks
What it brings back
Web vulnerability findings supported by concise, reproducible evidence.
Controlled exploit validation
Intruder
Understand the impact behind a finding.
Intruder validates the impact of an assigned vulnerability through a bounded, authorized exploitation objective. Starting from existing evidence, it gathers the minimum proof needed to demonstrate the issue’s impact.
- Exploit validation
- Impact confirmation
- Proof collection
What it brings back
Reproducible proof of the demonstrated impact within the authorized scope.
Credential assessment
Locksmith
Put authentication strength to the test.
Locksmith evaluates credential strength in one assigned mode: offline assessment of supplied hashes or encrypted artifacts, or bounded online authentication testing. It returns evidence with sensitive results redacted.
- Offline assessment
- Authentication testing
- Redacted results
What it brings back
Evidence-backed credential assessment results with sensitive material redacted.
AI security assessment
Whisperer
Explore the boundaries of AI behavior.
Whisperer examines how an assigned AI model or agent behaves under security testing. It assesses prompt injection, jailbreak resistance, and disclosure behavior, capturing evidence that can support repeatable regression checks.
- Prompt injection assessment
- Behavioral testing
- AI security regression
What it brings back
Reproducible observations of AI behavior and its security boundaries.
Interactive shell usage
From exploitation to an interactive reverse shell
DrowAI can drive Metasploit through msfconsole to validate an exploitable path, establish an interactive reverse shell, and navigate the remote host while every action remains visible to the operator.
Controlled session
Authorized Engagement
Scope, targets, and rules.
Operator Objective
A focused goal to pursue.
Red Team Agent
Plans, reasons, and guides.
Controlled Kali Container
Isolated tool execution.
Structured Knowledge
Linked assets and evidence.
Agentic Report
Report-ready findings.
Product workflow
A guided loop from objective to report
Human-in-the-loop control
Work runs inside a controlled Kali container
Evidence becomes report-ready knowledge
Agent capabilities
Mission-critical tools, augmented by a full shell
DrowAI gives the agent specialized tools for reliable, repeatable security workflows. Full shell access extends those capabilities, letting the agent run any command available inside its isolated task environment when the mission requires more.
Full shell execution
Run any command available inside the isolated task environment, compose scripts and pipelines, and use task-specific utilities beyond the structured tool catalog.
Workspace and artifact operations
Read, search, create, edit, organize, and inspect files and directories while keeping task artifacts inside the controlled workspace.
Host discovery and network mapping
Use structured discovery and scanning workflows to identify reachable hosts, open services, and relevant network relationships.
HTTP analysis and content discovery
Make HTTP requests, inspect responses, retrieve web content, and discover application paths through repeatable agent-facing tools.
Controlled exploitation workflows
Search, inspect, and execute supported modules and validation steps within the engagement's authorized scope.
Remote service interaction
Use structured SSH and FTP workflows to validate supplied access, inspect remote directories, and retrieve task-relevant artifacts.
Packet and protocol inspection
Inspect packet captures and protocol activity to surface relevant connections, behaviors, and evidence for the task.