The first cybersecurity framework with 7 specialized AI agent teams working in parallel with isolated contexts
Full Operation • Features • Teams • Installation • Usage • Reports
Security Team by ConcordIA / TITAN is a revolutionary framework that orchestrates 7 specialized AI security teams. Each team operates with its own isolated context, but they can communicate and collaborate in real-time to execute complex security operations.
┌─────────────────────────────────────────────────────────────────────────────┐
│ 🛡️ SECURITY TEAM by ConcordIA / TITAN │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ 🔴 RedTeam 🔵 BlueTeam 🟣 PurpleTeam 🟢 GreenTeam │
│ ═══════════ ═══════════ ═════════════ ═══════════ │
│ Pentesting Detection Validation DevSecOps │
│ Exploitation Response Simulation SAST/DAST │
│ Recon Forensics Gap Analysis Container Sec │
│ │
│ ⚪ WhiteTeam 🟡 YellowTeam 🟠 OrangeTeam │
│ ═══════════ ═════════════ ═════════════ │
│ Compliance Architecture Awareness │
│ Risk Mgmt Threat Model Phishing Sim │
│ Audit Zero Trust Training │
│ │
├─────────────────────────────────────────────────────────────────────────────┤
│ ✅ Isolated Contexts ✅ Inter-Team Communication ✅ Unified Reports │
└─────────────────────────────────────────────────────────────────────────────┘
The most powerful feature: The AI takes full control and executes complete security operations autonomously.
| Language | Triggers |
|---|---|
| English | |
| "Full operation against [target]", "Pentest [target]", "Hack [target]", "Attack [target]", "Pwn [target]", "Red team [target]", "Penetration test [target]" | |
| Spanish | |
| "Full operation contra [target]", "Pentest de [target]", "Hackea [target]", "Ataca [target]" | |
| Portuguese | |
| "Pentest em [target]", "Ataque [target]" | |
| French | |
| "Test d'intrusion sur [target]" | |
| German | |
| "Penetrationstest auf [target]" |
User: "Pentest example.com"
🤖 AI: Taking full control...
═══ PHASE 1: RECONNAISSANCE ═══
🔴 [RedTeam] Running reconnaissance...
> nmap -sV -sC example.com
> subfinder -d example.com
> nuclei -u example.com
[+] 3 subdomains found
[+] Ports: 22, 80, 443, 3306
═══ PHASE 2: VULNERABILITY ANALYSIS ═══
🔴 [RedTeam] Scanning for vulnerabilities...
[CRITICAL] SQLi found at /api/users?id=
═══ PHASE 3: EXPLOITATION ═══
🔴 [RedTeam] Exploiting SQLi...
> sqlmap -u "example.com/api/users?id=1" --dump
[+] Database dumped: 1,547 users
═══ PHASE 4: DEFENSIVE ANALYSIS ═══
🔵 [BlueTeam] Analyzing detections...
[!] WAF did not block the attack
[!] No alerts in logs
═══ PHASE 5: VALIDATION ═══
🟣 [PurpleTeam] Mapping to MITRE ATT&CK...
- T1190: Exploit Public-Facing Application
- T1059: Command Injection
═══ PHASE 6: REPORT ═══
📊 Generating mega report...
[+] Report: reports/example-com-20240504/
✅ OPERATION COMPLETED
| Situation | AI Decision |
|---|---|
| Port 80/443 open | → Full web scan |
| SQLi detected | → Immediate exploitation |
| Access obtained | → Post-exploitation |
| WAF detected | → Bypass techniques |
| No web vulns | → Pivot to other vectors |
7 specialized teams working simultaneouslyCompletely isolated contexts per project and teamSecure communication between teams viasecteam share
Intelligent orchestration that assigns tasks to the right teamFULL OPERATION MODE- AI executes everything automatically
-
Automated reconnaissance (subdomains, ports, services)
-
Vulnerability exploitation (web, network, API)
-
Post-exploitation and lateral movement
-
Payload generation and bypasses
-
Real-time threat detection
-
Forensic incident analysis
-
Proactive threat hunting
-
SIEM/IDS/IPS integration
-
MITRE ATT&CK attack simulation
-
Detection validation
-
Automated gap analysis
-
Purple Team exercises
Findings by team with severity and evidenceCVEs and CWEs identifiedExploits and payloads usedAccess obtained and credentialsExposed secrets foundRemediation recommendations****Activity timeline
| | | | | | | | | | |
- Linux (Kali Linux recommended)
- Python 3.8+
- Docker & Docker Compose
- Git
git clone https://github.com/MartinCrespoC/Security-Team---Workspace-.git
cd Security-Team---Workspace-
sudo ./install.sh --full
sudo ./install.sh
IMPORTANT: After installation, configure the required .env
files:
cp RedTeam/.env.example RedTeam/.env
cp BlueTeam/.env.example BlueTeam/.env
cp OrangeTeam/.env.example OrangeTeam/.env
nano RedTeam/.env
Common environment variables:
| Variable | Description | Teams |
|---|---|---|
SHODAN_API_KEY |
||
| Shodan API key | RedTeam | |
VIRUSTOTAL_API_KEY |
||
| VirusTotal API key | BlueTeam | |
SLACK_WEBHOOK |
||
| Webhook for notifications | All | |
SMTP_SERVER |
||
| SMTP server for phishing | OrangeTeam |
secteam status
secteam new client-project-xyz
secteam red # 🔴 Red Team
secteam blue # 🔵 Blue Team
secteam purple # 🟣 Purple Team
secteam green # 🟢 Green Team
secteam white # ⚪ White Team
secteam yellow # 🟡 Yellow Team
secteam orange # 🟠 Orange Team
secteam share BlueTeam vulnerability-report.md
secteam report client-project-xyz
secteam list
secteam new operation-aurora
secteam red
secteam blue
secteam purple
secteam report operation-aurora --full
The framework generates Mega Reports with all operation information:
📁 reports/
└── 📁 operation-aurora-20240504/
├── 📄 EXECUTIVE_SUMMARY.md
├── 📄 FULL_REPORT.md
├── 📁 findings/
│ ├── 📄 critical.md
│ ├── 📄 high.md
│ ├── 📄 medium.md
│ └── 📄 low.md
├── 📁 evidence/
│ ├── 📁 screenshots/
│ ├── 📁 logs/
│ └── 📁 payloads/
├── 📁 exploits/
│ ├── 📄 CVE-2024-XXXX.md
│ └── 📄 custom-exploits.md
├── 📁 credentials/
│ ├── 📄 hashes.txt
│ ├── 📄 cracked.txt
│ └── 📄 secrets.md
└── 📄 REMEDIATION.md
| Section | Content |
|---|---|
| Executive Summary | |
| High-level summary for executives | |
| Findings | |
| Vulnerabilities by severity (Critical/High/Medium/Low) | |
| CVEs Identified | |
| List of CVEs with description and CVSS | |
| CWEs Mapped | |
| Weaknesses categorized by CWE | |
| Exploits Used | |
| Code and payloads used | |
| Access Obtained | |
| Compromised systems and access level | |
| Credentials | |
| Hashes, cracked passwords, API keys | |
| Exposed Secrets | |
| Tokens, keys, certificates found | |
| Timeline | |
| Operation chronology | |
| Responsible Team | |
| Which team discovered each finding | |
| Remediation | |
| Recommended fixes with priority |
This workspace works with any AI-powered IDE:
| IDE/Assistant | Configuration File | Status |
|---|---|---|
| Windsurf | ||
.windsurfrules |
||
| ✅ | ||
| Cursor | ||
.cursorrules |
||
| ✅ | ||
| GitHub Copilot | ||
.github/copilot-instructions.md |
||
| ✅ | ||
| Cline/Claude Dev | ||
.clinerules |
||
| ✅ | ||
| Gemini | ||
.gemini |
||
| ✅ | ||
| Claude | ||
CLAUDE.md |
||
| ✅ |
Simply open the workspace in your IDE and request:
"Pentest example.com"
"Analyze these logs for malicious activity"
"Scan the code for vulnerabilities"
"Create a threat model for the application"
"Generate an ISO 27001 compliance report"
The AI will automatically identify which team(s) should act and execute the appropriate tools.
Security-Team---Workspace-/
│
├── 🔴 RedTeam/ # Offensive tools
│ ├── tools/
│ ├── scripts/
│ ├── wordlists/
│ └── .env.example
│
├── 🔵 BlueTeam/ # Defensive tools
│ ├── rules/
│ ├── playbooks/
│ ├── iocs/
│ └── .env.example
│
├── 🟣 PurpleTeam/ # Validation
│ ├── atomic-tests/
│ ├── detections/
│ └── mappings/
│
├── 🟢 GreenTeam/ # DevSecOps
│ ├── scanners/
│ ├── policies/
│ └── pipelines/
│
├── ⚪ WhiteTeam/ # GRC
│ ├── frameworks/
│ ├── policies/
│ ├── audits/
│ └── templates/
│
├── 🟡 YellowTeam/ # Architecture
│ ├── threat-models/
│ ├── architectures/
│ └── requirements/
│
├── 🟠 OrangeTeam/ # Awareness
│ ├── campaigns/
│ ├── training/
│ └── templates/
│
├── 📁 .contexts/ # Context configuration
│ └── config.json
│
├── 📁 .projects/ # Projects (isolated contexts)
│
├── 📁 .shared/ # Shared findings
│
├── 📁 .windsurf/workflows/ # Automation workflows
│
├── 📁 reports/ # Generated mega reports
│
├── 🔧 secteam # CLI Orchestrator
├── 🔧 install.sh # Unified installer
├── 📄 .windsurfrules # Windsurf config
├── 📄 .cursorrules # Cursor config
├── 📄 .clinerules # Cline config
├── 📄 .gemini # Gemini config
├── 📄 CLAUDE.md # Claude config
├── 📄 LICENSE # License
└── 📄 README.md # This file
This framework is designed exclusively for authorized use in:
- Authorized penetration testing
- Contracted security assessments
- Ethical security research
- Lab environments and CTFs
Unauthorized use of these tools is illegal and strictly prohibited.
This project is under the Security Research License. See LICENSE for details.
Contributions are welcome. Please read the contribution guidelines before submitting a PR.
Martin Crespo
🛡️ Break Everything. Protect Everything. Report Everything. 🛡️