Most adversary emulation runs. None of them assert.
Crucible is a security testing engine with an opinion: every scenario carries a ground-truth assertion — what should happen, what shouldn't, and why. Run it through Synapse plus Chimera for the integrated path, or point it at your own stack and measure what your defender actually catches against the same scenarios.
An attack you can't verify is just an attack you watched.
Composable attack chains. Verifiable outcomes.
Each scenario is a directed graph of attack steps: recon, exploit, escalate, exfil, with branching, retries, and dependency-aware execution. Steps run in parallel where they can; assertions evaluate at every transition. The result isn't "the test ran." The result is did the defender stop it, did it stop only what it should have, and where in the kill chain did the policy actually fire.
Discover. Attack. Analyze. Report.
Every Crucible run follows the same four-stage pipeline. Because the stages don't change between runs, two assessments a month apart stay directly comparable — a regression shows up as an assertion that used to pass and now doesn't.
Built for measurement, not theater.
Composable attack graphs with parallel, sequential, and conditional steps. Custom scenarios author in YAML, built-in playbooks ship with the engine. Every step maps to MITRE ATT&CK technique IDs.
Map results to NIST 800-53, CIS Controls, PCI DSS, HIPAA. Generate audit-ready evidence automatically. Track which controls actually fired during real attack execution.
Optional adaptive mode generates attack paths based on discovered vulnerabilities. The engine probes, observes responses, and synthesizes the next step. Finds combinations static scanners miss.
Executive summaries for non-technical leaders, technical deep-dives with full request/response capture, remediation roadmaps tied to source. Export PDF, JSON, NDJSON, or pipe to SIEM.
From scenario authoring to verdict report.
14 scenarios. 11 pass. 3 controls fail.
A typical run against the integrated stack: Synapse defending, Chimera as target, Crucible asserting. The output below shows pass/fail per scenario, mapped to NIST and HIPAA controls, with remediation guidance attached to each failure — compliance evidence earned by running the attacks, not by filling out a questionnaire.
Crucible is the assertion engine of Atlas Crew Security.
On its own, Crucible runs adversary emulation against any target you point it at. Inside the platform, it runs against Chimera's standardized vulnerable surfaces, with traffic flowing through Synapse as the inline defender. That's the whole point: the assertions only mean something when there's a defender in the path. Bring your own WAF if you want to measure your existing stack against the same scenarios.
See the platform →Run scenarios in one command.
Install the CLI from npm and run scenarios against your own targets,
or use
npx @atlascrew/bridge up
for the full integrated stack with Synapse and Chimera wired in.