Generate attacks, run them against your models, apps and guardrails, judge every response and tune your defenses — in one repeatable chain.
Find the weak spots before anyone else does. Fix them before launch.
Why red teaming
Guardrails and AI firewalls are only a guess until something tries to break them. Invictus Red attacks first, so you know what holds before a real attacker finds out.
The platform
Every step lives in one place, so you can run the same loop again for every model and every release.
01 · Attack
Ready-made attacks in many languages, mapped to the standards you follow.
Advanced filters
Stack filters for framework, category, severity, language, target type, attack surface and more. The count updates as you go, and every attack is mapped to the frameworks you report on.
Forge
Pick the method that fits the job: a fixed prompt collection, template variations, prompts an AI model writes from your objective, or simulated multi-turn conversations. Review what Forge makes, then publish it to the library.
Dynamic Attacks
Dynamic attacks read each reply and change tactics, like a real attacker. Choose a technique such as TAP, PAIR, Crescendo or GOAT, or PAIR+, built for AI firewalls, and point it at your target.
Strike Lists
Collect attacks into Strike Lists, like a release gate or a data leak suite, and run them again against one target or many at once. Every change is saved as a new revision, so results stay comparable.
02 · Test
Your models, your own apps and your guardrails — tested side by side.
Targets
Connect model providers, the chatbots and APIs you built, and the guardrails and AI firewalls in front of them. Then send the same attacks to each.
Workflow
Workflow carries your selection through every stage: Strike List, responses and evaluations. Each target gets its own path and runs on its own. Save a workflow and start it again with one click.
Processes
Tests continue in the background after you close the tab. Follow every run in Processes and resume a stopped step where it left off.
03 · Evaluate
Every answer is checked automatically, so you know what got through.
Evaluation methods
Read the guardrail’s own block or allow decision, with no AI model needed, or let an AI reviewer decide whether each attack succeeded, using a security rubric you can adjust. In a Workflow, every target gets the method that fits it.
Guardrail scoring
Every attack carries the behavior you expect. Each guardrail decision is scored against it: correct blocks, missed blocks, unnecessary blocks and correct allows, with accuracy, precision and recall on top.
Explained results
Open any result to read the explanation next to the prompt, the response and the expected behavior. Show only the incorrect ones, break results down by Strike List and export what you see as CSV.
04 · Analyze
Narrow results by app, attack type, language or risk. Every number follows.
Filters
Narrow results by target, evaluation, Strike List, attack type, language, severity or date. Attack success rate and every breakdown update together, and the link keeps your view, ready to share.
Breakdowns
Group results by responses, evaluations, Strike Lists or evaluation method and compare attack success side by side. Rank the categories and techniques that fail most, then follow the attack tree down to a single technique.
Frameworks
See attack success rate per framework and per control for OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act, ISO 42001, ISO 23894 and KVKK, and find the controls that have no tests yet.
Drill down
Click a bar, a count or a control to open the results behind it, then any single result with its prompt, response, expected behavior and explanation.
05 · Harden
Better policies are tried on your live guardrail. You promote the winner.
Guardrail Optimization
Optimize starts from how your current policy performs, studies where it fails and proposes better candidates. Each one is compared on the same examples and checked on data it hasn’t seen.
Policy Lab
Every guardrail and policy on your AI firewall, in one place. Build from a shared library or templates, see what each change affects, then review and publish. The firewall is read back to confirm it matches.
Real traffic
Review what your AI firewall saw in production and publish real prompts as new attacks, so the next run covers what people actually tried.
Inside the app
Jump between related records, give every team its own workspace, look up any framework and load-test your AI firewall.
Follow a run from Strike List to responses and evaluation. Switch to a sibling record from a searchable menu, or jump straight to the next step.
Give each team or customer its own workspace: separate data, users and resource limits, on the same installation.
A built-in wiki of security frameworks, controls and techniques and how they connect, plus a graveyard to review and restore archived records.
Measure successful requests per second, p95 latency and error rate. Run one load level or a concurrency sweep that stops itself at your limits.
Integrations
Product names and logos are trademarks of their respective owners.
OpenAI
Anthropic
Google Gemini
Azure OpenAI
OpenRouter
LiteLLM
Ollama
LM Studio
LangChain
LangGraph
LlamaIndex
CrewAI
OpenCode
n8nReady to deliver
Deploy in your own environment, license offline, keep your data on your own installation.
On-prem or any cloud providerYour own isolated install. No shared servers, no shared data.
Offline licensingActivated without calling home.
Agent interfacesLet AI agents run tests for you.
Roles & permissionsControl who sees and runs what.
Secrets in a dedicated vaultKeys and credentials kept apart from app data.
Attack. Prove. Harden.
Automated red teaming for AI systems