RedAmon vs RedLens AI

RedAmon is a free, open-source framework for authorized red-team operations, including reconnaissance, exploitation and post-exploitation. It maps attack surfaces from domains, IP/CIDR targets or batches of domains, then merges findings into a Neo4j graph that its AI agent can query for planning and exploitation. GVM/OpenVAS provides network vulnerability scanning with more than 170,000 NVTs; separate tools detect secrets and scan for vulnerable or malicious packages against a local OSV database. The Secret Multiscanner has 1,060 detectors across 14 sources and optional live API verification. RedAmon supports twelve AI providers and more than 400 language models, and its MCP server lets external agents drive the framework. The Dockerized application runs on Linux, macOS and Windows and supports on-prem deployment. Tools, scanners and agents run in separate containers with per-job ephemeral filesystems and network namespaces. Rules of Engagement, approval gates and scope controls govern operations, with a guardrail blocking government, military and intergovernmental targets. The project warns that configured API keys and credentials are stored unencrypted in PostgreSQL, leaving database security to the user.

RedLens AI runs automated adversarial attacks against production AI systems and maps findings to controls used in security audits. It is aimed at healthcare, law enforcement and regulated enterprise organizations deploying AI. Its Master Attack Schema v2.0 covers six attack categories and 22 methodologies, with findings scored by CVSS. Each assessment produces a PDF containing a risk score, vulnerabilities, remediation steps and mappings to frameworks including HIPAA, NIST AI RMF, OWASP GenAI Top 10, MITRE ATLAS, ISO/IEC 42001, FBI CJIS Security Policy and AIUC-1. The mappings are evidence, not certification. Retests can run daily or weekly to detect drift, and critical findings can trigger logged email alerts. A Python CLI and GitHub Action support CI/CD scans with severity gates and SARIF output; findings can stream to listed SIEM services or an HMAC-signed webhook. Deployment options include hosted SaaS and Enterprise self-hosted Docker. In the self-hosted package, stored data stays in the customer's Postgres, but attack generation and judging still call Anthropic's API using the customer's key. The Free plan includes 25 hosted scans monthly; paid plans start at $199.00 per month, while Developer starts at $799.00 per month.