Skip to content
SPECIFICTION
Get listed

Infection Monkey

techdocs.akamai.com

Free plan WebWindowsLinuxSelf-hosted
Visit techdocs.akamai.com
Spec score 8.0 #3 of 20 in Breach and Attack Simulation Software

What it is

Infection Monkey is an open-source breach and attack simulation tool for checking data center resilience to perimeter breaches and internal server infection. Monkey Agent scans systems and simulates attack techniques, while Monkey Island Server provides a command-and-control web interface. The tool maps visible machines, accessible services, and possible routes through a network, then reports security issues the agents discover or exploit. It supports on-premises environments, containers, and public and private clouds. The documented AWS integration uses Systems Manager to run Infection Monkey on EC2 instances, and plugins can be installed, updated, removed, or uploaded through the Monkey Island interface. Internet access is not required; when available, it is used to check for updates and whether machines can reach the internet. The FAQ says sensitive data is encrypted in the Island database and sent to agents over HTTPS, and that first launch requires creating credentials for access to the server. It also says the tool avoids exploits or attacks that may affect target systems, including EternalBlue. The Free plan is free.

Spec sheet

Purpose
Infection Monkey is an open-source breach and attack simulation tool for testing data center resilience to perimeter breaches and internal server infection.Read 5 Oct 2026 · techdocs.akamai.com
Intended users
Akamai describes the tool as a way for organizations to validate security controls and identify how attackers might exploit network security gaps.Read 5 Oct 2026 · akamai.com
Support
The project offers a public Slack workspace, support email, and GitHub issue reporting.Read 5 Oct 2026 · techdocs.akamai.com
Founded
2017Read 28 Sep 2026 · techdocs.akamai.com
Account security
On first launch, users create credentials, after which the Monkey Island server is accessible only with those credentials.Read 5 Oct 2026 · techdocs.akamai.com
Architecture
It consists of Monkey Agent, which scans and simulates attack techniques, and Monkey Island Server, a C&C web server with a user GUI.Read 5 Oct 2026 · techdocs.akamai.com
AWS integration
The documented integration uses AWS Systems Manager to execute Infection Monkey on EC2 instances.Read 5 Oct 2026 · techdocs.akamai.com
Credential protection
The FAQ says sensitive data such as passwords, SSH keys, and hashes are stored encrypted in the Island database and sent to agents over HTTPS.Read 5 Oct 2026 · techdocs.akamai.com
Internet access
Internet access is not required for operation; when available, it is used to check for updates and whether machines can reach the internet.Read 5 Oct 2026 · techdocs.akamai.com
Network map
The product maps visible network machines, accessible services, and potential propagation routes.Read 5 Oct 2026 · techdocs.akamai.com
Platform requirements
The documented Monkey Island runs on x86-64 processors, with Linux and Windows operating systems listed as supported.Read 5 Oct 2026 · techdocs.akamai.com
Plugin support
Plugins extend functionality and can be installed, updated, removed, or uploaded through the Monkey Island interface.Read 5 Oct 2026 · techdocs.akamai.com
Safe operation
The FAQ says the product avoids exploits or attacks that may impact victim systems, including EternalBlue.Read 5 Oct 2026 · techdocs.akamai.com
Security report
Its report presents security issues discovered or exploited by the agents.Read 5 Oct 2026 · techdocs.akamai.com
Supported environments
Akamai says the product supports on-premises environments, containers, and public and private clouds.Read 5 Oct 2026 · akamai.com

Plans and prices

Free Free Open-source breach and attack simulation tool Read 5 Oct 2026 · techdocs.akamai.com

Every Infection Monkey plan and price →

Strong points and limits

Strong points

  • Maps visible machines, services, and possible routes
  • Reports security issues discovered or exploited
  • Supports on-premises, container, and cloud environments
  • Can operate without internet access

Limits

  • Monkey Island requires x86-64 processors
  • Documented Monkey Island operating systems are Linux and Windows
  • Operation involves an agent and a web server

Who it suits

Infection Monkey suits organizations that want to validate security controls and examine potential paths through networks across on-premises, container, or cloud environments. It is a self-hosted tool with Linux and Windows listed for Monkey Island.

Verdict

Infection Monkey provides network mapping and attack simulation with a report of discovered issues, and can run without internet access. Its agent-and-server architecture and documented platform requirements matter when planning deployment.

Where Specifiction places it

Alternatives to Infection MonkeyAll alternatives →