productOct 12, 2026
Awshook: 173 programs for AWS offense
Awshook is 173 deterministic programs that walk the full MITRE ATT&CK kill chain against an AWS account, from recon to impact, all through the AWS CLI and REST APIs.
Team
Founder & Maintainer
Orhan Yildirim
Orhan founded CyberStrike and maintains the project. He works across the agentic pentesting engine, the DAST pipeline and the platform that ties them together.
About
He spends most of his time on how findings are verified and prioritized, so teams act on real risk instead of noise.
Writing
Posts by Orhan
View all posts
productOct 12, 2026
Azure cloud security testing: a capabilities reference
How CyberStrike's Azure cloud domain works: a two-layer pipeline of 154 deterministic programs feeding 13 specialist AI agents, with 367 CIS benchmark skills and ~130 CWE mappings.
productOct 12, 2026
Azurehook: 154 programs for Azure offense
Azurehook is the deterministic execution layer behind CyberStrike's cloud domain: 154 programs that recon, extract, escalate, persist, move laterally, evade, exfiltrate and audit, all through Azure's own APIs.
white-papersOct 12, 2026
Beyond the Scanner
AI-augmented penetration testing, across web and cloud: how CyberStrike pairs a deterministic engine and an industry-standard toolchain with reasoning AI agents, and lets them work alongside your own testers.
researchOct 12, 2026
How we do agentic web testing
A short, first-person look at how CyberStrike splits a web assessment across specialist agents, keeps the reasoning with the AI, and uses a deterministic signal layer so evidence is never lost.
productOct 12, 2026
You, augmented: how pentesters and teams actually use CyberStrike
CyberStrike is AI-augmented, not AI-only. Here is how security engineers and teams drive it: mixing manual and autonomous testing, keeping a human in command, and shaping the models, agents, playbooks and rules.
newsJul 31, 2026
Cyber Security News covers CyberStrike's automated pentest platform
Cyber Security News profiled CyberStrike as an AI-powered platform that automates reconnaissance, vulnerability discovery, exploitation and reporting from the terminal.
newsJun 23, 2026
Arctic Wolf reverse-engineers the FortiBleed harvester
Arctic Wolf Labs tore down the Go-based credential tool recovered from FortiBleed, showing how perimeter captures on FortiGate firewalls turn into full internal-network compromise.
newsJun 23, 2026
The Hacker News: FortiBleed hit FortiGate with no new zero-day
The Hacker News reported on FortiBleed, a Russian-speaking access broker that harvested 110M+ credentials from FortiGate and other gateways, without a single new vulnerability.
newsJun 20, 2026
SoCRadar's 'Dismantling FortiBleed' maps the full operation
SoCRadar's Threat Research Unit published a 77-page teardown of FortiBleed: 430,000+ FortiGate firewalls in scope, 659 harvest cycles, 110M+ credentials, and a breach at a NATO-aligned defense contractor.
newsJun 19, 2026
SpyCloud maps the FortiBleed threat-actor infrastructure
SpyCloud traced the servers behind FortiBleed and found FortiGate was only one target class in a broad, multi-vendor initial-access-broker operation.