Platform Quickstart

Achieve end-to-end security and compliance for AI at scale.

From AI discovery to compliance attestation, on platform for complete visibility across you AI ecosystem.

01 CONNECT

02 DISCOVER

03 BILL OF MATERIALS

04 GOVERNANCE

05 VULNERABILITIES

06 DOCUMENT LIBRARY

07 COMPLIANCE

08 ARENA & SHIELD

-- THIRD-PARTY PUBLISHING

-- PUBLIC API

-- REFERENCE

-- SUPPORT

WELCOME

Visibility across your entire AI ecosystem

This Quickstart walks you through the Cranium platform from first integration to compliance attestation. Whether you are securing AI systems, mapping regulatory requirements, or building an inventory of AI assets across your organization, this guide gets you there.

What you will have at the end

THE JOURNEY

Eight stages, one track

BEFORE YOU BEGIN

Have these ready

• Cranium tenant provisioned - Contact your account manager if you need one.
• Repository admin access - Administrator rights to your organization's code repositories.
• Access credentials prepared - A Personal Access Token or OAuth authorization for your VCS (see below).

Access Credentials by Platform

GitHub Personal Access Token with repo scope, or OAuth authentication

GitLab Personal Access Token with read_repository scope

Bitbucket Personal Access Token with repository:read scope

Azure DevOps Personal Access Token with Code (read) scope

STAGE 01 | CONNECT

Connect Your Repositories

Establish Version Control System Integration

INSTRUCTIONS

1. Open Integrations from the left navigation and select the VCS Integrations tab.
2. Click Add New VCS Integration above the integrations list.
3. Complete the Create VCS Integration dialog: Name (descriptive), Description (optional), Service (your VCS platform), Base URL (root domain, including an organization name where required), and Authentication Method (Personal Access Token, or OAuth for GitHub).
4. Click Save to establish the connection.

Detailed Docs

• Accessing a Private VCS

STAGE 02 | DISCOVER

Discover Your AI Assets

Discover Repositories, Then Run Detect AI

INSTRUCTIONS

1. Open Integrations from the left navigation and select the VCS Integrations tab.
2. On your VCS integration row, click Discover Repos to run Discovery. Cranium finds the projects and repositories in that integration and populates the Detect AI tables (re-run later with Re-run Discovery in the row flyout).
3. When Discovery completes, the row action becomes Detect AI. Click it (or open Detect AI from the left navigation) to review the discovered projects, groups, and repositories.
4. Run Detection: use Run Detect AI on a single repository or group, select items and click Detect AI in Selected, or choose Detect AI Everywhere to scan all repositories.
5. Review results on the Repositories tab (per-repo AI Detected) and the VCS Projects / Orgs / Groups tab, which rolls up scan results and AI-detected counts per project or group.

Detailed Docs

• Detect AI Overview
• Integrations Overview

STAGE 03 | BILL OF MATERIALS

Create Your First AI BOM

Generate a Comprehensive Component Inventory

INSTRUCTIONS

1. Navigate to Artifacts > Bill of Materials.
2. Click Add Bill of Materials.
3. Selected a scanning method: Public Repository (direct GitHub URL), Private Repository (from a connected VCS), or Inventory (from Detect AI discoveries).
4. Capture BOM details: Name (a descriptive identifier), Description (system purpose and context), and Owner (the responsible party).
5. Start the scan with Save & Scan Repository.

Detailed Docs

• Creating a Bill of Materials with CodeSensor
• Inventory Bulk Actions

STAGE 04 | GOVERNANCE

Establish AI Governance

Create Your First AI System, and Generate the AI Card

INSTRUCTIONS

1. Navigate to AI System Manager > My AI Systems.
2. Click Add AI System.
3. Define the system identity: Name, Description (purpose and capabilities), and Owner (accountability).
4. Click Continue to proceed.
5. Complete the governance details.
6. Attach relevant artifacts: the Bill of Materials from Step 3, compliance frameworks, and supporting documentation.
7. Click Save. The AI Card is generated automatically from this record.

Detailed Docs

• Adding a New AI System

STAGE 05 | VULNERABILITIES

Assess Security Posture

Review Findings on the Vulnerabilities Page

INSTRUCTIONS

1. Open Vulnerabilities from the left navigation.
2. Switch between the Models and Technologies tabs. Models list adversarial attack-category findings with a Vulnerability Likelihood score; Technologies lists CVE findings from detected packages with CVSS scores and severity.
3. Toggle Show Severity Statistics to see Critical, High, Medium, and Low count for the active tab.
4. Filter by AI System, BOM, model, or severity to focus on what matters most.
5. Resolve, ignore, or restore findings as you work through them, and use Export Vulnerabilities to push all or filtered results into your vulnerability-management workflow.

Details Docs

• Vulnerability Management

STAGE 06 | DOCUMENT LIBRARY

Build Your Document Library

Upload Policy and Governance Documents

INSTRUCTIONS

1. Navigate to Document Library in the left navigation.
2. Click Add Document.
3. Upload your governance documents: AI governance policies, Standard Operating Procedures, risk-management frameworks, and data-handling and privacy policies.
4. Wait for document processing to complete.
5. Confirm documents appear with Processed status before continuing.

Detailed Docs

• Document Library Overview

STAGE 07 | COMPLIANCE

Establish Compliance

Attach and Complete a Framework

INSTRUCTIONS

1. Within you AI System, click Add Artifact.
2. Select Compliance Framework.
3. Choose a framework: NIST AI RMF Starter Pack v2 (Compliance Agent supported), EU AI Act, or ISO/IEC 42001.
4. Complete the framework questions.
5. Click Evaluate Answers for scoring.

Detailed Docs

• Self-Attesting to a Compliance Framework
• Compliance Agent

STAGE 08 | ARENA & SHIELD

Test Your Defenses

Arena and Shield — Adversarial Posture and Guardrail Effectiveness

Arena performs automated red-teaming of discovered LLMs across eight attack categories: jailbreaks, prompt injection, encoding attacks, hallucinations, harmful response generation, misinformation, data leakage, and cyberattack enablement. Shield then measures how well your safety guardrails block those attacks, returning per-category block rates and exposing gaps in your defense configuration.

INSTRUCTIONS

1. Navigate to Arena Shield and click Start a New Test Run.
2. Enter a descriptive Test Run Name.
3. Select your Base Model, populated from LLMs discovered in your AI BOMs (only Arena-testable models appear).
4. Choose a System Prompt: Template (a preconfigured adversarial prompt), Discovered (extracted from the model's BOM), or Custom.
5. Click Configure Guardrails to add defense models: Input defense screens prompts before they reach the model; Output defense screens responses before delivery.
6. Click Begin Test Run and monitor progress on the results page.
7. Review per-category results: block rate per attack category, breakthrough rate, and overall defense effectiveness score.

Detailed Docs

• AI Arena Overview
• Arena Shield Overview

BEYOND THE JOURNEY

Third-party publishing

INSTRUCTIONS

1. Navigate to AI System Manager > Published AI Cards and click Publish AI Card. You can also start from an AI System's detail page via Publish New AI Card > To Organization.
2. Recipient Details. Select or add the recipient organization, entering its name and a contact point: first name, last name, and email.
3. Configure Card. Choose the AI System to publish, give it a Published Name, and attach the artifacts to include: Bill of Materials, Vulnerability Reports, Compliance Frameworks, and Document Library files.
4. Review & Publish. Confirm the recipient, published name, and attached artifacts, then click Publish.
5. Locate the card under Published AI Cards, where you can track its status and manage it.

Detailed Docs

• Publishing an AI Card Without a Request
• Responding to an AI Card Request

INTEGRATE

Cranium Public API

Cranium exposes a Public API for teams that prefer to integrate platform capabilities into their existing toolchain rather than driving them through the UI. Typical use cases include:

• Export vulnerability findings into your existing vulnerability-management workflow, such as Jira or ServiceNow.
• Put Bill of Materials data into your internal asset inventory or SBOM consolidation tooling.
• Surface Arena model inventory and attack-category data in your security-operations dashboards.

API documentation, authentication, and the endpoint reference live under the Public API category on docs.cranium.ai.

Detailed Docs

• Public API Reference

REFERENCE

Glossary

• AgentSensor - The component of CodeSensor that scans specifically for AI agent frameworks and agentic patterns, including tool-calling architectures, multi-agent orchestration, and memory structures.
• AI BOM - AI Bill of Materials. A comprehensive inventory of an AI system's components: models, datasets, dependencies, and configuration. Cranium's equivalent of a software BOM, specialized for AI.
• AI Card - Cranium's standardized transparency artifact for an AI system, summarizing identity, ownership, BOM, vulnerability posture, and compliance status in a format suitable for external sharing.
• AI System - Cranium's central governance record for an AI/ML system. Anchors ownership, attached artifacts, and ongoing assessment.
• Arena - Cranium's automated red-teaming environment. Tests LLMs across eight attack categories, from jailbreaks and prompt injection to data leakage and cyberattack enablement.
• Arena Shield - Cranium's guardrail-effectiveness testing. Measures how well defense models block adversarial attacks across the same eight attack categories.
• CodeSensor - Cranium's code-analysis engine. Catalogs models, datasets, and technologies using three-tier analysis: package extraction, AST-based analysis, and LLM-powered code understanding.
• Compliance Agent - Automation that maps policies and SOPs to framework requirements and generates citation-backed answers. Currently supports NIST AI RMF Starter Pack v2.
• CVE - Common Vulnerabilities and Exposures. The industry-standard catalog of publicly disclosed security vulnerabilities, maintained by MITRE.
• Detect AI - Cranium's automated discovery of AI/ML code across connected repositories.
• EU AI Act - The European Union regulatory framework governing AI systems, with tiered obligations based on risk classification.
• ISO/IEC 42001 - The international standard for AI management systems, focused on responsible AI governance.
• MITRE ATLAS - Adversarial Threat Landscape for Artificial-Intelligence Systems. A MITRE knowledge base of adversary tactics targeting AI.
• NIST AI RMF - The U.S. NIST AI Risk Management Framework. A voluntary framework for managing AI risks.
• OSV - Open Source Vulnerabilities. A distributed vulnerability database for open-source software.
• OWASP ML Top 10 - The Open Web Application Security Project's catalog of the top ten machine-learning security risks.
• PAT - Personal Access Token. An authentication credential used in place of a password for programmatic access to a VCS.
• VCS - Version Control System. A source-code management platform such as GitHub, GitLab, Bitbucket, or Azure DevOps.

WE ARE HERE TO HELP

Secure and govern AI, with a team behind you.

Questions are you work through the platform? Reach the people and resources that can help you move faster.

• Support Portal - support.cranium.ai
• Knowledge Base - docs.cranium.ai
• Training - learn.cranium.ai
• Email - [email protected]