AUTOCYBERX: AN ORCHESTRATED OPEN-SOURCE FRAMEWORK FOR AUTOMATED PENETRATION TESTING AND RISK ANALYSIS

Abstract

Manual penetration testing remains resource-intensive and time-consuming, while commercial automated platforms impose high subscription licensing costs that restrict small-to-medium enterprise adoption. Existing open-source security utilities perform individual verification checks effectively, but require security practitioners to manually chain disjointed tools together and parse inconsistent command outputs. This paper presents AutoCyberX, a self-hosted desktop penetration testing platform built to automate workflows from target discovery to report generation within a unified, rule-driven pipeline. Operating on a Kali Linux environment, AutoCyberX integrates a Flask backend, a single-page web interface, and a local SQLite database to execute scans locally without cloud dependencies. The system orchestrates over 15 open-source security tools through a rule-based decision engine that dynamically selects appropriate assessment modules across four fully implemented execution profiles. Controlled evaluation across 50 supervised live websites demonstrates that AutoCyberX reduced redundant tool execution by 38.5% and filtered out 64.1% of unverified false positives while effectively automating vulnerability assessment, multi-framework compliance mapping (OWASP Top 10, PCI-DSS v4.0, ISO/IEC 27001), and executive PDF reporting.