Cairn Security is not the AI tool in that story.
On 20 October 2026, Dark Reading published an article that identified Cairn Security as the AI penetration-testing tool criminals abused to attack e-commerce sites. That identification is wrong. We are a different company that happens to share the name, and here are the facts.
What the article got wrong
The piece, “Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree” by Elizabeth Montalbano, treats our company as the maker of the tool it describes. In its opening sentence it hyperlinks the tool’s name, “Cairn,” directly to our website, cairnsecurity.com, and it refers to “the platform” as though it were ours. It is not. We did not build that tool, and we had nothing to do with the activity the article describes.
What is actually true
Cairn Security (this site, cairnsecurity.com) is a cybersecurity company and the maker of a penetration-testing platform that security teams use to run and report their own authorized testing. We do not build, sell, or run offensive tooling.
The tool in the story is a separate, unrelated open-source project that also happens to be called Cairn. We did not create it, do not maintain it, and have no connection to it. The attacks were investigated and reported by a security firm called NorForge, which the article cites. NorForge did not build the tool, and neither did we. We share nothing with that project but the name: no code, no team, no funding, and no relationship of any kind.
What we have asked for
We have written to Dark Reading and to the article’s author and asked them to remove the link from “Cairn” to our website, correct the identification of Cairn Security as the tool, and publish a correction. We will update this page when they respond.
Common questions
Is Cairn Security the AI pen-test tool that attackers abused?
No. Cairn Security is a cybersecurity company and the maker of a penetration-testing platform at cairnsecurity.com. The open-source AI tool of the same name is a separate, unrelated project that we did not build and do not operate.
Who makes the open-source Cairn AI pen-test tool?
A different, unaffiliated group publishes it, not Cairn Security. We have no connection to that project, its code, or the people behind it.
Is the Cairn Security platform related to that tool in any way?
No. There is no shared code, team, funding, or business relationship. The only thing in common is the name Cairn, a common English word for a stack of stones used as a landmark.
Was Cairn Security involved in the attacks reported in the press?
No. Cairn Security builds software that security firms use to run and report their own authorized testing. We do not run attacks, and we had no involvement in the activity those reports describe.
Writing about this and want to get it right? Please get in touch and we will confirm every detail on this page.