CyberKB When Your AI Copilot Runs Recon, Crawls the Dark Web, & Maps Kill Chain

The speakers open with a problem familiar to penetration testers: engagements produce large volumes of noisy scan output, and teams often follow only two or three attack paths before writing a report. They present CyberKB, a proof-of-concept platform, and its language-model assistant Keke, which runs tools against ingested data. They argue that a retrieval knowledge base becomes necessary once an environment reaches very large asset counts, since flat Markdown files stop scaling.

The middle of the talk covers the architecture. Several cooperating agents handle a copilot role, goal monitoring, campaign tasks and an observer that retries failed steps. The platform ingests historical DNS and certificate records, sets up missing tools or writes its own scripts when there is no internet access, and can spread scanning across cloud instances. The speakers said the tool was tested on a Hack the Box machine, taking about six hours to reach an initial foothold and roughly twelve hours to finish, and on a prompt-injection CTF. They also described self-adjusting prompts with a human approval step, and admitted that smaller local models give inconsistent tool calls and that techniques missing from the knowledge base cause failures.

The main takeaway for practitioners is the idea of keeping all collected recon data searchable so earlier findings are reused rather than lost, and of treating model-driven output as something to validate. The talk is framed as a proof of concept rather than a product, and the accuracy and performance figures were given without independent benchmark data.