Getting Started

Getting Started with XHack

Welcome to XHack — the AI-powered cybersecurity platform. Everything runs in your browser, and the autonomous Agent is a desktop app you download and click into. There is no command line — if you can use a web app, you can use XHack.

This guide takes you from zero to your first AI security task in five short steps.

What you get

XHack brings a full security toolkit under one login:

• AI Chat — a security-focused assistant for research, analysis, and report writing.
• Autonomous Agent — a desktop app that runs real pentests hands-off (more below).
• Image Reading (OCR) — drop a screenshot or PDF in and the AI reads the text out of it.
• AI Skills — reusable expertise packs you switch on for a specific discipline.
• AI Models / BYOK — use the built-in model, or connect your own provider key.
• GitGuard — AI scans every GitHub pull request for security issues.
• SOC Dashboard — ingest logs, detect threats, correlate attack chains, manage incidents.
• AI Probe — test your own AI systems against the OWASP LLM Top 10.
• Vulnerability Assessment — register assets and run AI-driven scans.

Step 1 — Create your account

Head to app.xhack.io and sign up. Verify your email, and you're in. You can register as an individual researcher or as a company — the difference is only how you get verified in the next step.

Step 2 — Get verified

XHack hands out real offensive capability, so we confirm who's holding it before granting access. Verification happens before any payment — you're never charged while your application is reviewed.

• Researchers upload a government ID and at least one security credential (OSCP, CEH, CISSP, or a security degree). A public verification link speeds things up.
• Companies verify the owner's identity plus basic business details (legal name, company number, country). Colleagues you invite later inherit that verification.

Most decisions land within one business day. See the Identity Verification guide for the full checklist.

Step 3 — Choose a plan

Once approved, pick the plan that fits your work. Researchers get individual AI plans; companies get team plans with seats, scans, and SOC volume. Every paid plan includes AI Chat, the Agent, Image Reading, and AI Skills — higher tiers add BYOK and more. Compare them on the pricing page.

Step 4 — Open your workspace

Your workspace is your home base — dashboard, chat, assets, settings, and every tool in the left-hand menu. Take a minute to look around; nothing here can touch a target until you point it at one.

Step 5 — Run your first task

Two easy ways to start:

A. Ask the AI something. Open Chat and ask a real question — "explain this CVE," "review this HTTP response for injection points," "draft a report section for a stored-XSS finding." Attach a screenshot or PDF and it'll read that too.

B. Run the autonomous Agent. For hands-off testing, install the desktop Agent (next step) and point it at an authorized target. It plans, tests, and reports on its own. See Installation.

The desktop Agent, in plain terms

The XHack Agent is a fully graphical desktop application — no terminal, no commands. You:

1. Download and install it from the install page.
2. Sign in with your XHack account.
3. Point it at an authorized target and describe the goal.
4. Watch it work — recon, testing, and a written report, live on screen.

Prefer to keep everything on your own machine? The Agent can run against a local Ollama model for fully offline, air-gapped assessments. See Local AI with Ollama.

A note on authorization

XHack is for authorized security work only — your own systems, or targets you have explicit permission to test. Verification exists to keep it that way. See Restrictions & Prohibited Activities.

What's next?

• Installation — download and set up the desktop Agent
• Prompting Guide — get sharper results from the AI
• Capabilities & Use Cases — what XHack can do, with examples
• Bring Your Own Key — connect your own AI provider
• AI Skills — load reusable expertise packs
• Image Reading (OCR) — read text out of screenshots and PDFs