Decepticon Tutorial: Deploy & Run Your First Autonomous Red Team Engagement
Hands-on Decepticon tutorial: install via one-liner, onboard with the wizard, define RoE and OPPLAN, watch the agent chain exploits in sandboxed containers, and analyze the Neo4j knowledge graph.
Decepticon promises autonomous red teaming without babysitting. In this hands-on tutorial, we walk through a real deployment and your first engagement — from Docker setup to watching the agent chain exploits and map its findings into Neo4j.
🚀 Want to deploy Decepticon yourself?
Docker configs, system requirements, and installation guides — all on one page.
View Decepticon Tool Page →Step 1: Install & Onboard
Requirements: Docker + Docker Compose v2. On macOS, Linux, or WSL2:
curl -fsSL https://decepticon.red/install | bash
decepticon onboard # interactive wizard: provider, API keysThe wizard configures your LLM provider (the decepticon-litellm container proxies model calls) and sandbox networking. Windows users run irm https://decepticon.red/install.ps1 | iex in PowerShell.
Step 2: Launch the Web UI
decepticonOpen the dashboard in your browser. You'll see your sandboxed environment status, the Neo4j graph view, and the engagement console. Every command the agent runs is executed inside an isolated container and logged.
Step 3: Define the Engagement
Instead of a vague "hack this IP" prompt, Decepticon asks for the full package: Rules of Engagement, scope, objectives, and deconfliction windows. It then generates a ConOps + OPPLAN with MITRE ATT&CK mapping before acting. This is the discipline layer that makes it a real red team tool.
Step 4: Watch the Kill Chain
Kick off the engagement. The agent performs reconnaissance, identifies services, selects exploits, escalates privileges, and attempts lateral movement — adapting as it goes. Key highlights you'll see in the console:
| Phase | What the Agent Does |
|---|---|
| Recon | Port scans, service fingerprinting, tech detection |
| Exploitation | Crafting payloads, chaining CVEs, dropping into interactive shells |
| Post-exploit | Privilege escalation, credential hunting, lateral movement |
| Mapping | Every finding written to the Neo4j knowledge graph |
Step 5: Analyze the Knowledge Graph
After the run, open Neo4j. Hosts, services, credentials, and attack paths are connected as graph nodes — so you can visualize the full compromise chain and turn it straight into a report for your defenders.
⚖️ Legal first: Decepticon enforces RoE, but authorization is on you. Only run it against systems you own or have written permission to test. No exceptions.
Verdict
Decepticon is the closest thing to a real autonomous red team operator in open source — 98.08% pass rate on XBOW benchmarks, genuine interactive shells, and graph-based reporting. It's heavier than a scanner (expect 4–8 GB RAM), but it's in a completely different league.
🚀 Deploy Decepticon in minutes
Requirements, Docker Compose, and install guide on the tool page.
View Decepticon Tool Page →