Nebula AI-Powered Penetration Testing Platform Automates Security Assessments

Nebula is an open-source AI-powered penetration testing assistant built to bring large language model support directly into security testing workflows.

The tool, developed by BerylliumSec, works from the command line and helps authorized security teams with vulnerability assessment, reconnaissance support, note-taking, external tool analysis, and engagement documentation.

The official Nebula GitHub repository describes the project as an AI-powered penetration testing assistant for automating recon, note-taking, and vulnerability analysis.

What Nebula Does

Nebula is designed for ethical hackers, developers, and security professionals who already work inside terminal-based workflows. Instead of replacing tools such as scanners, scripts, or reporting utilities, it adds an AI layer around them.

The platform can analyze terminal output, import external tool data, create structured notes, capture screenshots, and provide contextual suggestions during an authorized assessment.

BerylliumSec’s Nebula project page says the tool combines AI-driven testing with open-source cybersecurity tools to help teams perform vulnerability assessments and improve cyber defenses.

Feature	Purpose	Why It Matters
Terminal AI assistant	Lets users ask questions and analyze command output inside the workflow.	Reduces switching between tools, notes, and browser searches.
External tool integration	Works with CLI-invokable security tools and imported data.	Allows teams to keep existing testing workflows.
Automated notes	Records and categorizes findings during engagements.	Helps improve documentation quality and reporting speed.
Screenshot capture	Captures and annotates evidence for reports.	Supports cleaner audit trails during assessments.
Local and cloud model support	Supports local inference and API-backed models.	Gives teams more control over privacy, speed, and cost.

Supported Models and Deployment Options

Nebula supports multiple AI backends. The project documentation lists OpenAI API-accessible models, Meta’s Llama-3.1-8B-Instruct, Mistral AI’s Mistral-7B-Instruct-v0.2, and DeepSeek-R1-Distill-Llama-8B.

Local inference can run through Ollama, while cloud-backed use requires API keys for the selected provider. This gives teams a choice between keeping model execution local or using hosted model services.

The nebula-ai PyPI package lists version 2.0.0b31 as the latest release, published on April 6, 2026, with support for Python 3.10 through 3.13.9.

How Nebula Fits Into a Security Team’s Workflow

Nebula’s main appeal is workflow consolidation. Penetration testers often move between terminals, browser tabs, notes, screenshots, ticketing systems, and reporting templates.

The tool aims to keep more of that work in one interface. Users can switch between manual terminal use and AI-assisted queries by using the tool’s interaction controls.

The current GitHub documentation also says Nebula supports any tool that can be invoked from the CLI, which means it can sit alongside existing assessment utilities rather than forcing teams into a new stack.

Installation and System Requirements

Nebula is distributed as a Python package and can also run through Docker. For CPU-based inference with Ollama, the current project documentation lists at least 16GB of RAM.

The package metadata also shows Nebula as a beta-stage project. That matters for enterprise teams because beta tooling usually requires extra testing before use in production-like environments.

According to the PyPI listing, Nebula is tagged for AI, ethical hacking, Nmap, ZAP, and CrackMapExec, which signals its intended use in authorized cybersecurity workflows.

Key Capabilities Listed by BerylliumSec

BerylliumSec highlights several features aimed at reducing repetitive work during vulnerability assessments. These features focus on context, documentation, and assisted analysis rather than fully replacing human testers.

• AI-powered internet search for current cybersecurity context.
• AI-assisted note-taking during security engagements.
• Real-time suggestions based on terminal tool output.
• External tool data import for AI-assisted review.
• Screenshot capture and image annotation for documentation.
• Manual notes and automatic command logging.
• A status feed that shows recent testing activity.

Why Local Model Support Matters

Security teams often handle sensitive customer systems, internal IP ranges, vulnerability details, and evidence screenshots. Sending that information to an external model can create compliance and confidentiality concerns.

Local model support gives teams another option. A tester can run supported models locally when data handling requirements do not allow cloud processing.

The Nebula documentation site also points users to logs stored under the local Nebula data directory, which can help teams troubleshoot runtime issues without relying only on external support.

DAP Adds a Malware Analysis Angle

BerylliumSec also promotes Deep Application Profiler, or DAP, alongside Nebula. DAP focuses on malware and executable analysis rather than penetration testing workflow support.

The Microsoft Marketplace listing describes DAP as an AI-powered anti-malware solution for one-shot zero-day threat detection through executable intent analysis.

The listing says DAP uses neural networks and natural language processing to analyze executable intent, provide risk scores, and generate human-readable explanations for analyst review.

Security Benefits and Limits

Nebula reflects a wider shift in cybersecurity tooling. AI assistants are moving closer to the tools that security teams already use every day.

That can save time during authorized assessments, especially when a tester needs to organize evidence, interpret noisy output, or prepare cleaner report notes.

However, teams should not treat AI output as final proof. Security findings still need validation, business impact review, scope checks, and human approval before reporting or remediation work.

Responsible Use Remains Essential

AI-assisted penetration testing tools can improve efficiency, but they also increase the need for strong rules of engagement. Any assessment should remain limited to systems where the tester has clear authorization.

Organizations evaluating Nebula should review its permissions, data handling behavior, model configuration, logs, and integration points before allowing it in sensitive environments.

For malware analysis workflows, the DAP marketplace page shows how BerylliumSec is positioning its broader product line around AI-assisted cybersecurity analysis.

What Comes Next for Nebula

BerylliumSec says its roadmap includes custom models that are more useful for penetration testing. That suggests future versions may become more specialized for security work rather than relying only on general-purpose models.

For now, Nebula’s main value is its ability to bring AI assistance into a familiar command-line workflow. It gives security teams another way to manage context, notes, screenshots, and analysis during authorized vulnerability assessments.

As AI-assisted security tools become more common, the strongest deployments will combine automation with clear governance, human review, and strict engagement boundaries.

FAQ