Announcing our partnership with Elastic Security to easily integrate Operator and test the efficacy of your defenses.



The simplest cloud range. Operator supports extending its platform through the Cloud plugin - which helps crank up the realism index when running security assessments. For instructions on how to install the Cloud plugin and an in-depth look at its features, read this.

Provision Redirectors

A redirector is a Linux server that can accept network connections from the internet and proxy (redirect) them to a different computer. You can deploy an agent anywhere in the world and have it connect to your redirector instead of your desktop directly. When you use a redirector, agents don't know your IP address.

Switchboard (Pro)

Switchboard is a systems application that allows you to easily share an agent’s beacons with teammates. You can give your Switchboard’s host and password to a teammate, who can enter it in their Operator instance to connect. Switchboard allows a team to share a single agent.

Launch Pre-Compromised Servers

Why provision test servers? You may work on a MacOS and not have access to a Windows computer to test an attack on. Provisioning a real test machine allows you to quickly test your TTPs.

Connect Your SIEM To Close The Loop

Deploy multi-machine test ranges, including a connected SIEM, verify if your SIEM analytics are actually working, and work with our pre-configured integrations with Splunk.


Adversary Emulation

Mimic known threats to your organization by combining threat intelligence and continuous red teaming to emulate attacks.


Defensive Training

Train yourself or your organization on real-world attacks using the first training platform integrated directly into an attack emulation platform. Perform attacks and learn how to stop them.


Desktop Application

Prelude takes care of the complexity behind the scenes and delivers Operator as the first desktop application in autonomous red-teaming. Simple design and free to use, download it here.


Continuously Updating

New TTPs and training content added every week (and sometimes, daily). Stay up-to-date, automatically. Threat intelligence, adversary creation, TTPs and training content all updated within the desktop app.