Everything we've written on this blog so far has been about XCloak Security Suite — detection, response, multi-tenancy, the parts of the product that watch a system that's already deployed. Today we're introducing something different: XCloak Recon, a second product, currently in beta, that answers a question Security Suite doesn't try to: what's wrong with this system before someone attacks it.
You describe a target in plain English — "Scan example.com for vulnerabilities" — and an AI planner turns that into a real penetration test: it selects tools, runs them in isolated containers, re-analyzes the combined output to strip false positives, scores what's left by severity, and generates a report. It's not a wrapper around a single scanner with a chat interface bolted on; it's an orchestration layer over seven separate tools that most pentesters already trust individually, with the tedious parts — sequencing, correlating output formats, filtering noise — handled automatically.
Why an AI planner, not a script
The naive version of this idea is a fixed pipeline: always run nmap, then always run nuclei against whatever ports came back, then always run gobuster. That works until the target doesn't match the assumptions the pipeline was written for — no open web ports, an unusual service on a nonstandard port, a subdomain structure that needs enumeration before anything else is useful. A fixed pipeline either runs irrelevant tools anyway (wasted time, wasted noise) or misses the tools that would've actually mattered for this specific target.
Recon's planner reads the stated goal and the target's actual characteristics, then decides what to run and in what order — nmap before nuclei because nuclei needs to know what's open first, gobuster only if there's a web server worth enumerating. After the tools run, a second AI pass looks at the combined output specifically to remove false positives, which matters more than it sounds: raw tool output from seven different scanners run against the same target contains a lot of duplicate and noisy findings that a human would otherwise have to manually triage before the report is trustworthy.
Docker isolation, not shared execution
Each of the seven tools — nmap, nuclei, gobuster, sqlmap, nikto, ffuf, whatweb — runs in its own container, not in a shared execution environment. These are tools with real capability to send traffic, brute-force paths, and in sqlmap's case, attempt actual injection payloads against a target. Running them in a shared process space means one tool's failure mode (a bad flag, an unexpected timeout, a crash) can affect the others mid-scan. Per-tool isolation means a single container can be killed, resource-limited, or restarted without disturbing the rest of the pipeline, and it keeps each tool's blast radius — network access, filesystem access — scoped to exactly what that one tool needs.
The same approval philosophy as Security Suite
We wrote before about why every destructive SOAR playbook action in Security Suite requires a human click instead of running automatically. Recon follows the same principle in a different context: after the initial scan, the AI proposes follow-up tasks — deeper enumeration on a port that looked interesting, a targeted check against a service that returned an unusual banner — and those proposals sit and wait for your approval before anything runs. The initial scan you asked for executes; anything beyond that is a suggestion, not an autonomous decision. It's the same reasoning as the SOAR gate: an AI system that's right most of the time still shouldn't get to expand its own scope unattended, especially when "expand scope" here means "send more traffic at a target."
CVSS risk scoring includes stop conditions for the same reason — a scan that's escalating toward something that looks like it needs explicit sign-off doesn't get to keep escalating on its own.
Where it stands today
Recon is in beta and under active testing — the pipeline, the tool set, and the pricing tiers described here may all change before general availability. What's live right now: the full eight-step pipeline (plan → validate → execute → analyze → score → propose → approve → report), WebSocket streaming of tool output as it happens, PDF report generation, a searchable findings database, scheduled/recurring scans, and a runtime-switchable LLM provider (Ollama locally, or OpenAI/Claude).
You can try it at app.xcloak.tech. As with any scanning tool: only point it at targets you own or have explicit written permission to test — target allowlisting is enforced at the platform level, not left as policy.