Adversaries increasingly automate offensive workflows; defensive teams need tools that simulate not just scanners but realistic attacker behaviour under operational discipline. Decepticon focuses on replicating full kill chains under documented rules — so you test detection and response against adversary-like sequences rather than isolated tool outputs.
What Sets It Apart
- Engagement-first workflow: before any network activity, Decepticon generates a complete engagement package (RoE, ConOps, Deconfliction Plan, OPPLAN) with MITRE ATT&CK mapping, so exercises are auditable and constrained.
- Realistic attack chains: agents cover reconnaissance, exploitation, privilege escalation, lateral movement and C2, chaining techniques adaptively rather than running checklist scans.
- Interactive tooling and sandboxing: offensive tools run inside persistent interactive shells (tmux) within a dedicated Kali sandbox and isolated operational network; the management plane is separated from the sandbox to reduce risk.
- Modular orchestration and model-aware fallbacks: 16 specialist agents, model/provider tiering, and runtime orchestration let teams balance cost, capability, and confidentiality.
Who It's For and Trade-offs
Great fit if you run authorized red-team exercises or purple-team validation and need attacker-like engagements that feed directly into defensive improvements. It is also useful for security researchers benchmarking detection coverage with realistic chains.
Look elsewhere if you only need lightweight vulnerability scanning or compliance-oriented automated reports: Decepticon assumes an operator-controlled environment, nontrivial infra (Docker, sandbox, optional Neo4j), and disciplined legal/authorization processes. It is not for unauthorized use and carries operational and legal responsibilities that teams must accept and manage.
