Find the weakness in your network before the hackers do
Portainer-AiSecure runs simulated attacks from inside your network, directed by a self-hosted open-weight model that you run, and hunts for systems that are already compromised. It is built on MisterShell.
- Simulated attacks on network-attached devices and applications, run from agents inside each network segment
- A coordinator in your core directs the agents and connects to your model
- The model is an enterprise self-hosted, open-weight LLM that you run, so attack coordination stays inside your boundary
- Agents also listen to the network to hunt systems that are already compromised, and can act on what they find
- Built on MisterShell and deployed as Core, Kubernetes, or Edge
Attackers now use frontier models
Attackers now use frontier models to plan and run attacks against the networks they reach. The same capability is available to you, run inside your own network segments against your own devices and applications, without any of your dirty secrets being leaked to an external party.
Find the weaknesses
Simulated attacks on network-attached devices and applications show you where they can be attacked, before someone else tries.
Find what is already inside
Agents listen to the network on their segment to hunt systems that are already compromised, and can act on what they find.
A coordinator in your core, an agent in every segment
Portainer-AiSecure has two parts. The coordinator is a central MisterShell deployment in your core. The agents run at the edge, one in each network segment. The coordinator directs the agents, and the agents carry out the work from inside the segment they sit in.
The coordinator
A central MisterShell deployment in your core. It connects to your model and directs the agents.
The agents
Run at the edge, one per network segment. Each runs simulated attacks on the network-attached devices and applications in its segment, and listens to the network to hunt systems that are already compromised.
Your model
An enterprise self-hosted, open-weight LLM that you run. It coordinates and creates the attacks, and it is unrestricted for authorized security testing. Portainer can recommend a model if you need one.
MisterShell is the platform underneath
Portainer-AiSecure is built on MisterShell, a self-hosted privileged access and fleet intelligence platform. These are the controls your security team gets with it.
Self-hosted
You choose where data lives. Licensing is offline and never phones home.
Identity and access
Local, LDAP, OIDC, and SAML sign-in, MFA, and roles scoped per location and feature.
Recorded evidence
Session replay, the policy log, approvals, and security audit trails, each kept as its own trail.
Log forwarding
Send MisterShell’s own audit events to syslog, your SIEM, or a webhook.
Three variants, one product
The value in all three is MisterShell. The variants differ in what it is delivered on, so choose by how you want to deploy it.
MisterShell
Portainer-AiSecure (Core)
MisterShell on its own, in any of the four topologies, from a single All in One container to distributed multi-region HA.
MisterShell + KubeSolo
Portainer-AiSecure (Kubernetes)
MisterShell delivered on KubeSolo, a single-node Kubernetes distribution light enough to run on a workstation.
MisterShell + KubeSolo + Nova8OS
Portainer-AiSecure (Edge)
The full bundle: MisterShell, KubeSolo, and Nova8OS delivered together for edge locations.
| Component | Core | Kubernetes | Edge |
|---|---|---|---|
| MisterShell | Included | Included | Included |
| KubeSolo | Not included | Included | Included |
| Nova8OS | Not included | Not included | Included |
What each variant includes. The MisterShell feature set is the same in all three.
Licensed per managed resource
A resource is one managed target registered in the MisterShell inventory, such as a host, a network device, a database, a cluster endpoint, or a cloud account. You license the number of resources you manage, in packs of 1,000, on a 1-year or 3-year subscription.
Everything included
The subscription is self-hosted and includes every MisterShell capability available during the term, with all product updates and new releases published in that time.
Enterprise Support
Included with the subscription.
Offline license file
Delivered electronically to your licensing email. No internet connection is required to run the product.
Add-ons quoted separately
The Proxy, IDS Sensor, and Syslog Collector add-ons are not part of the base subscription.
Portainer-AiSecure common questions
What is Portainer-AiSecure?
It finds weaknesses in your network before attackers do. A coordinator in your core directs agents at the edge, one per network segment, which run simulated attacks on network-attached devices and applications and listen to the network to hunt systems that are already compromised. It is built on MisterShell.
Which model directs the attacks?
An enterprise self-hosted, open-weight LLM that you run, unrestricted for authorized security testing. Portainer can recommend a model if you need one.
Which variant do I need?
The product is MisterShell in all three. Core is MisterShell on its own, Kubernetes adds KubeSolo, and Edge adds KubeSolo and Nova8OS. The choice is about how you want it delivered.
How is it licensed, and what does it cost?
Licensing is per managed resource, in packs of 1,000, on a 1-year or 3-year subscription, and the license is an offline file issued to your licensing email. Pricing is on request, so contact us and we will quote it for your estate.
Where can my security architects see the technical detail?
On the technical detail page, which covers the coordinator and agents, the platform controls, the architecture, and the deployment topologies.
See it run against a network like yours
We will walk you through Portainer-AiSecure and show how the variant that fits your estate is deployed.
- A walkthrough of the variant that fits your estate
- No obligation · a specialist will reach out to schedule
- Pricing quoted for your estate on request