Kali-AI v2 - Automated Pentest Platform on Hardened Ubuntu 24.04 LTS

Designed for MSSPs, security teams, red teams, and penetration testers who need repeatable automated assessments without SaaS pricing or data residency risk. All data stays on your EC2 instance.

## How It Works

Kali-AI v2 automatically executes Nmap, Nuclei, Nikto, WhatWeb, Gobuster, WPScan, and SQLMap in sequence. Findings are correlated, enriched with CVE data, and analyzed by Claude AI to produce an executive summary, risk rating, attack path analysis, remediation plan, and NIST/PCI-DSS/ISO 27001 compliance observations - delivered as a polished 10-section PDF.

## Key Features

• **7-Tool Automated Pipeline:** Nmap, Nuclei, Nikto, WhatWeb, Gobuster, WPScan, and SQLMap run automatically in sequence with no manual orchestration required.
• **Claude AI Analysis:** Every finding is risk-rated and written up by Anthropic Claude, producing actionable narratives rather than raw scanner output.
• **10-Section PDF Reports:** Professional reports ready to deliver to clients or stakeholders. White-label with your company name and logo. Email delivery on scan completion.
• **Security Score Dashboard:** Posture score (0-100, A-F), risk gauge, severity chart, and 7-day timeline.
• **Remediation Tracker:** Assign findings, set due dates, track status, and export to CSV.
• **Attack Path Visualization:** Interactive graph showing chained vulnerability sequences.
• **Scan Delta:** Compare new vs resolved vs persistent findings across assessments.
• **Scheduled Scans:** Cron-based recurring scans with Full, Quick, Web, or Network scan types.
• **Batch Scanning:** Up to 20 targets with parallel execution for MSSP workflows.
• **Client and Project Tagging:** Organize assessments by client and engagement.
• **Security Copilot:** AI assistant for plain-language queries about results and remediation.
• **RBAC:** Admin, analyst, and auditor roles with JWT authentication.
• **Integrations:** Slack and Teams webhooks, SIEM JSON export, and REST API for CI/CD pipelines.

## Security and Data Handling

The platform runs on a hardened Ubuntu 24.04 LTS base. The first-boot wizard ensures no default credentials exist. RBAC with JWT authentication controls access across roles. All scan data remains on your EC2 instance with no vendor data retention. API keys and SMTP credentials are stored in /opt/kali-ai/.env with restricted file permissions.

## Getting Started

• Launch an EC2 instance (t3.medium or larger, 30 GB EBS). Open port 80 in your Security Group.
• Browse to http://your-ec2-ip/ and complete the setup wizard.
• Create your admin account (12+ character password required).
• Add your Anthropic API key in Settings (obtain from console.anthropic.com - pay-per-use).
• Launch a scan. Try: scanme.nmap.org
• View the AI-analyzed PDF report in the Reports section.

## Evaluate Before You Commit

To assess report quality and platform capabilities, request a sample anonymized PDF report from Madarson IT before deploying. Launch a t3.medium instance and run a scan against scanme.nmap.org to experience the full scan-to-report workflow with minimal commitment.

## Requirements and Limitations

• An Anthropic API key is required for Claude AI analysis and is billed separately by Anthropic on a pay-per-use basis.
• Buyers should verify compatibility with their target EC2 instance types before deploying at scale.
• For HTTPS, deploy behind an AWS ALB or CloudFront distribution with an ACM certificate.

## Responsible Use

AUTHORIZED USE ONLY. For security testing of systems you have explicit written permission to test. Unauthorized use violates the AWS Acceptable Use Policy, the Computer Fraud and Abuse Act (CFAA), and equivalent laws.

## About Madarson IT

Madarson IT certified images are continuously updated, security-optimized, and built to meet enterprise requirements with minimal configuration. Madarson IT also offers hardened and custom images across AWS, GCP, and Azure Marketplace.