GET TITAN AI RUNNING IN YOUR ENVIRONMENT

Deploy TITAN AI in 10 Minutes

Zero-hassle setup. Works on Azure — pick any combo. Copy-paste commands. No compiler, no docker, no cluster. Just Python and your cloud CLI.

Every step is verified end-to-end: install → configure → authenticate → run → review → (optional) fix → rollback.

 ⚡ WHAT PROTECTS YOUR BOX
 ·
 Emergency kill switch (Ctrl-C / STOP file)
 ·
 Per-agent memory cap
 ·
 Wall-clock timeouts
 ·
 SLSA 3 signed bundle verification
 ·
 Graceful crash recovery
 ·
 Tamper-evident audit trail
 ·
 Full reliability brief »
 

Two ways to deploy — pick whichever fits your security team

⚡ OPTION A · RECOMMENDED

One-Click Smart Runner

Single command. Detects your OS. Installs missing tools (Python, cloud CLIs). Validates license. Authenticates you into Azure. Launches CONDUCTOR. ~90 seconds, zero manual setup.

# Linux / macOS
curl -fsSL https://titanaisec.com/titanai-run.sh | bash

# Windows (PowerShell as admin)
iwr -useb https://titanaisec.com/titanai-run.ps1 | iex

Prompts once for your license key. Opens your browser for cloud auth. CONDUCTOR's preflight handles run-mode decisions.

🔧 OPTION B · MANUAL CONTROL

Step-by-Step Walkthrough

For security-reviewed environments, air-gapped hosts, or teams whose policy requires manual installation. Every command documented, every step inspectable. ~10 minutes end-to-end.

Install prerequisites (Python, cloud CLI)

Download license-tied installer bundle

Configure .env

Verify (12-check integrity)

Authenticate your cloud(s)

Launch CONDUCTOR

Review + (optionally) apply fixes

Full step-by-step starts below.

Both paths produce the same outcome. Same signed bundle, same license validation, same CONDUCTOR flow, same 12-check integrity verification. The one-click just automates the connective tissue between steps.

Option C — Security-Reviewed Install (for enterprise CISOs / air-gapped)

If your security team forbids curl | bash patterns (common in finance, healthcare, DoD), or your corporate firewall blocks piped remote execution, use this path instead. Download, verify the SHA-256, inspect the script, then run locally. Every byte is checksummed and auditable before anything executes.

# Step 1 — Download the installer + its SHA-256 sidecar
curl -fsSL -o titanai-run.sh https://titanaisec.com/titanai-run.sh
curl -fsSL -o titanai-run.sh.sha256 https://titanaisec.com/titanai-run.sh.sha256

# Step 2 — Verify integrity (should print "OK")
sha256sum -c titanai-run.sh.sha256

# Step 3 — Inspect the script (your security team reviews)
less titanai-run.sh # or: cat titanai-run.sh

# Step 4 — Run locally, with your license
bash titanai-run.sh # prompts for license key

Windows PowerShell equivalent

# Download + verify + run (PowerShell)
Invoke-WebRequest -Uri https://titanaisec.com/titanai-run.ps1 -OutFile titanai-run.ps1
Invoke-WebRequest -Uri https://titanaisec.com/titanai-run.ps1.sha256 -OutFile titanai-run.ps1.sha256

# Verify SHA-256
$expected = (Get-Content titanai-run.ps1.sha256).Split(' ')[0]
$actual = (Get-FileHash titanai-run.ps1 -Algorithm SHA256).Hash.ToLower()
if ($expected -ne $actual) { throw "SHA mismatch — do NOT run!" } else { Write-Host "OK" -ForegroundColor Green }

# Inspect
notepad titanai-run.ps1

# Run
.\titanai-run.ps1

Published SHA-256 checksums (verify these match what you downloaded)

Pin these in your change-control ticket so the security team can attest the binary they reviewed is the one that ran.

File	SHA-256	Size
`titanai-run.sh`	`20a334d38f3f3ad214b49037b1cf90b55d45e0ec02eb6e696fb7a40a4ffd741a`	13 KB
`titanai-run.ps1`	`aa352cbd5c4460cb9be5d439723d86a6a14862d205a428a41b3ceb391934809b`	6.5 KB
`install.sh`	`319ddc4409f7be50be6d6324d84a7ca17dca13e4633f4325748c9687421b3cbc`	8.8 KB
`install.ps1`	`937bf26ad16318bbf23436103909b348b854ebf92b628f29a5c249f057122427`	5.9 KB
`titanai-latest.tar.gz`	`def1d1917a4ef7f936f14c8b2e008676459843167882d32b606a216aefac4930`	484 KB

All checksums also served at <file-url>.sha256 (e.g. /titanai-run.sh.sha256). Auto-fetch for scripted verification.

Why this path satisfies enterprise security review: no piped remote execution, every byte is SHA-verified before run, the script is inspectable plaintext, the downloaded bundle is signed & checksummed, and every file has a published integrity hash. This is the same pattern HashiCorp, Kubernetes, and Grafana use for their enterprise installers.

How TITAN AI reaches your environment

Complete transparency on how the product gets from our infrastructure to yours. Source code is never publicly distributed. Only signed, license-tied bundles, served over HTTPS from Cloudflare's edge. Your cloud credentials never leave your machine.

┌──────────────┐ 1. Sign up / buy a license
│ CLIENT │─────────────────────────────────► TITAN AI LLC
└──────┬───────┘ │
 │ │
 │ 2. You receive via email: │
 │ • Your license key │
 │ • URL: titanaisec.com/client-deploy.html │
 │◄─────────────────────────────────────────────────┘
 │
 │ 3. Open the URL, pick Option A or Option B
 ▼
┌────────────────────────────────────────────────────────────┐
│ https://titanaisec.com (Cloudflare Pages, global CDN) │
│ ├─ /titanai-run.sh one-click Linux/macOS │
│ ├─ /titanai-run.ps1 one-click Windows │
│ ├─ /install.sh core Linux/macOS installer │
│ ├─ /install.ps1 core Windows installer │
│ ├─ /api/license/verify license validation endpoint │
│ └─ /bundles/titanai-X.Y.Z.tar.gz signed bundle + SHA256 │
└────────────────────────────────────────────────────────────┘
 │
 │ Script validates license + downloads signed bundle
 ▼
┌──────────────┐
│ YOUR HOST │ 4. Everything runs LOCALLY on your machine.
│ │ Nothing phones home except the ONE
│ ~/.titanai/ │ license-verify call. No telemetry.
│ │
│ CONDUCTOR ──┼──► 5. Scans YOUR cloud with YOUR credentials
│ │ Produces reports, backups, snapshots
│ │ ALL DATA STAYS ON YOUR MACHINE.
└──────────────┘

What a client gets in email from TITAN AI

Subject: Your TITAN AI license is ready

Hi [Client Name],

Your TITAN AI license is active. Here's everything you need:

 License key: TITAN-LIVE-XXXXX-XXXXX-XXXXX-XXXXX
 License tier: [launch | cloud-pro | healthcare | banking | ...]
 Expires: YYYY-MM-DD
 Deploy guide: https://titanaisec.com/client-deploy.html

Fastest way to get running — one command:
 Linux/macOS: curl -fsSL https://titanaisec.com/titanai-run.sh | bash
 Windows: iwr -useb https://titanaisec.com/titanai-run.ps1 | iex

Questions? Reply to this email or write [email protected].

— TITAN AI Customer Success

Exactly what the one-click script auto-installs for you

The script detects your OS and installs only what's missing. Zero action needed from you — it figures out your distro, uses the right package manager, and handles everything.

What's installed	Ubuntu / Debian	RHEL / Oracle / Fedora	Arch	macOS	Windows
Python 3.10+	`apt`	`dnf`	`pacman`	`brew`	`winget`
pip, curl, unzip, tar	`apt`	`dnf`	`pacman`	`brew`	bundled
Azure CLI	Microsoft `InstallAzureCLIDeb`	Microsoft RPM repo	AUR note	`brew install azure-cli`	`winget Microsoft.AzureCLI`
Python dependencies	`pip install -r requirements.txt` into an isolated venv at `~/.titanai/.venv`

Install just the Azure CLI

The script installs the Azure CLI by default. For a non-interactive CI/CD run:

# Default: installs Azure CLI
curl -fsSL https://titanaisec.com/titanai-run.sh | bash

# CI/CD mode — license pre-set, no prompts, non-interactive
TITAN_LICENSE=TITAN-XXX TITAN_NON_INTERACTIVE=1 \
 bash -c "$(curl -fsSL https://titanaisec.com/titanai-run.sh)"

Data residency — the guarantee

Nothing leaves your machine except ONE license validation call. Your cloud credentials, your scan findings, your resource names, your compliance data — all stay on your host. Every report is written to ~/.titanai/reports/, every snapshot to ~/.titan-ai/snapshots/. We never see any of it. Ever.

Prerequisites (one-time, 3 minutes — Option B only)

Python 3.10+ Git pip Azure CLI TITAN AI license key External LLM API key (optional — unlocks AI analysis)

Don't have a license yet? You have two options:

Instant trial (14 days, no signup): use key TITAN-TRIAL-OPEN-PUBLIC-DEMO-2026 with any install path below. Read-only across all agents, zero risk.
Production license: email [email protected] or subscribe here. Unlocks fix-mode + full 33-agent suite.

Install Python (if not already installed)

# Windows (PowerShell):
winget install -e --id Python.Python.3.12

# macOS (Homebrew):
brew install [email protected]

# Linux (Ubuntu/Debian):
sudo apt update && sudo apt install -y python3.12 python3.12-venv python3-pip

# Linux (RHEL/Oracle Linux/CentOS):
sudo dnf install -y python3.12 python3-pip

Verify Python + pip

python --version # must be 3.10 or newer
pip --version # any recent version

Install the Azure CLI

# ───── AZURE CLI ─────
# Windows:
winget install -e --id Microsoft.AzureCLI
# macOS:
brew install azure-cli
# Linux:
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Step 1 — Install TITAN AI

Download your license-tied install package

Once we issue your license, you receive a personalized download link + signed installer. One line installs, gates on your license key, and wires up the Python environment automatically.

# Linux / macOS
curl -fsSL https://titanaisec.com/install.sh | sh -s -- \
 --license TITAN-XXXXX-XXXXX-XXXXX-XXXXX

# Windows (PowerShell as administrator)
iwr -useb https://titanaisec.com/install.ps1 | iex
# (installer prompts for your license key interactively)

The installer verifies your license against our server, downloads the signed TITAN AI bundle (~80 MB — includes Azure SDK, Anthropic client, Flask), and installs into ~/.titanai/ (Linux/Mac) or %LOCALAPPDATA%\TitanAI\ (Windows). Takes ~90 seconds.

Source code is not publicly distributed. Every bundle is cryptographically signed, keyed to your license, and tied to your organization. Source-review access for SOC2 / FedRAMP / HITRUST audits is available under NDA — email [email protected].

Step 2 — Configure

Create your `.env` file

Copy the template and fill in your license key + optional LLM API key.

cp .env.example .env
# Edit .env with your preferred editor
notepad .env # Windows
nano .env # Linux / Mac

Minimum required in .env:

TITAN_LICENSE_KEY=TITAN-LIVE-XXXXX-XXXXX-XXXXX
TITAN_LLM_API_KEY=...
# Azure scope (optional):
AZURE_SUBSCRIPTION_FILTER= # leave empty to scan all subs you're logged into

No Anthropic key? That's fine — agents will run without AI-enrichment summaries but still produce the same 100% real scan findings, compliance checks, and fix commands.

Step 3 — Verify Installation

Run the CONDUCTOR self-check (no scan yet)

python lab/verify-conductor.py

This validates every agent loads, every tier in the PACKAGE_MATRIX is well-formed, the license gate works, baseline snapshot writes, and cloud detection runs. No cloud calls, no LLM calls, no writes. Takes under 10 seconds.

Expected output: All 12 checks PASSED — CONDUCTOR flow verified end-to-end
If any check fails, email us the output. Don't proceed to Step 4.

Step 4 — Authenticate Your Cloud(s)

Sign in to each cloud you want scanned

TITAN AI uses YOUR existing cloud credentials — nothing gets uploaded to our servers, nothing leaves your machine.

Azure — 3 ways to authenticate

# Option A: Device Code login (recommended — MFA enforced via tenant policy)
az login --use-device-code
az account list --output table
az account set --subscription "Your Sub Name"

# Option B: Service Principal with certificate (best for CI/CD, headless)
az login --service-principal \
 --username  \
 --certificate  \
 --tenant 

# Option C: Service Principal with secret (legacy automation)
az login --service-principal \
 --username  \
 --password  \
 --tenant 

# Option D: Managed Identity (auto-detected on Azure VMs, App Service, AKS, etc.)
az login --identity
# TITAN picks up managed identity automatically — no commands needed on Azure hosts.

-->

Step 5 — Run TITAN CONDUCTOR

Start the orchestrator — it handles everything

python agents/conductor.py

CONDUCTOR will:

Take a baseline snapshot of account identity → ~/.titan-ai/snapshots/
Check your license → activates only agents you're entitled to
Detect cloud permissions → auto-degrades to read-only if no write access
Show you where data is stored (snapshots, backups, reports, logs)
Ask you two questions:
- Capture full BACKUP before scanning? [Y/n, default Y]
- Use STAGED workflow (audit first, fix later)? [Y/n, default Y]
Phase 1 — AUDIT: all read-only scanners run (Scout, Sentinel, Comply, Shadow, Audit…)
Pause for your review — you inspect findings in reports/
Phase 2 — FIX (only if your tier allows + you approve): Forge applies remediation, one fix at a time, each with [y/N] consent

Non-interactive (CI/CD) mode: if you're running inside a pipeline without a TTY, CONDUCTOR auto-detects and uses safe defaults (backup=yes, staged=yes, no AIRLOCK). Override with env vars:

TITAN_NON_INTERACTIVE=true \
TITAN_FULL_BACKUP=true \
TITAN_STAGED_WORKFLOW=true \
python agents/conductor.py

Step 6 — Review Findings

Every scan produces three deliverables

All local to YOUR machine. Nothing uploaded. Nothing leaves your environment.

Output	Location	Format
PRE-FIX report	`reports/TITAN-<date>-<vertical>-PRE-FIX.html`	HTML + PDF + DOCX
POST-FIX report	`reports/TITAN-<date>-<vertical>-POST-FIX.html`	HTML + PDF + DOCX
Summary JSON	`data/live-<date>-results.json`	JSON
Run log	`logs/conductor-<timestamp>.log`	plaintext

Every finding card has 8-section drill-down: resource ID, severity, recommendation, CIS/HIPAA/PCI control, fix command, before/after state, rollback plan, and Section 9 Exception/Approver form.

Step 7 — Apply Fixes (only fix-tier licenses)

Forge runs ONLY when all four gates are green

Gate	Who controls it
1. License tier is "fix" (not "audit")	Your purchase
2. Cloud credentials have write permissions	Your IT / IAM admin
3. You approve the audit review in Phase 1	You (operator)
4. Every individual fix asks `[y/N]` before applying	You (operator)

If ANY gate is missing (trial license, audit-only tier, read-only cloud creds, or you decline), Forge refuses and logs a clear reason. No surprise mutations. Ever.

How you know it's safe: TITAN_READ_ONLY=true env var gets set by CONDUCTOR before any agent runs if you're in trial/audit mode. Every write path in Forge checks this var and aborts if set.

Rollback (if anything needs undoing)

Two backup layers for every fix operation:

Baseline snapshot (always on, step 0) → ~/.titan-ai/snapshots/baseline-<timestamp>.json
Full backup (if you said Yes to the prompt) → ~/.titan-ai/backups/full-<timestamp>/
Per-fix rollback command recorded in actions[].rollback_plan inside the POST-FIX report — copy-paste to undo any single fix

Example rollback (Azure storage account)

# Pull the rollback command from the POST-FIX report's Section 9 card,
# or from the JSON:
cat data/live-2026-04-20-results.json | jq '.actions[] | {resource, rollback_plan}'
# Then run the specific command:
az storage account update --name titanphi4f29 --allow-blob-public-access true

Troubleshooting

"No valid TITAN AI license found"

Your TITAN_LICENSE_KEY isn't loading. Check:

cat .env | grep TITAN_LICENSE_KEY
# or in PowerShell:
Get-Content .env | Select-String TITAN_LICENSE_KEY

"Azure CLI not found"

# Windows:
winget install -e --id Microsoft.AzureCLI
# Mac:
brew install azure-cli
# Linux:
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

"Not logged in"

Run az login --use-device-code again, verify with az account show.

Scan is slow

First scan against a large tenant takes 5-15 min depending on resource count. Agents parallelize where possible. If a specific agent hangs, kill the process and rerun with TITAN_SKIP_AGENTS=aml,audit to exclude LLM-heavy ones.

Air-gapped / DMZ / classified deployment

Enable AIRLOCK mode — zero outbound traffic, local LLM only (Ollama). Requires AIRLOCK add-on or trial demo toggle. Contact sales for AIRLOCK pricing.

TITAN_AIRLOCK_RUNTIME=true python agents/conductor.py

Alternative: Docker (zero-install)

Don't want to touch Python? Pull our image, run one command.

# Pull the image
docker pull ghcr.io/titanaisec/titanai:latest

# Run CONDUCTOR (mounts your .env + Azure config, writes reports to host)
docker run --rm -it \
 -v "$PWD/.env:/app/.env:ro" \
 -v "$HOME/.azure:/root/.azure:ro" \
 -v "$PWD/reports:/app/reports" \
 -v "$PWD/data:/app/data" \
 -v "$HOME/.titan-ai:/root/.titan-ai" \
 ghcr.io/titanaisec/titanai:latest \
 python agents/conductor.py

Docker on Windows (PowerShell)

docker run --rm -it `
 -v "${PWD}/.env:/app/.env:ro" `
 -v "${HOME}/.azure:/root/.azure:ro" `
 -v "${PWD}/reports:/app/reports" `
 -v "${HOME}/.titan-ai:/root/.titan-ai" `
 ghcr.io/titanaisec/titanai:latest `
 python agents/conductor.py

Alternative: Kubernetes CronJob (scheduled scans)

apiVersion: batch/v1
kind: CronJob
metadata:
 name: titanai-nightly-scan
spec:
 schedule: "0 2 * * *" # 2 AM daily
 jobTemplate:
 spec:
 template:
 spec:
 serviceAccountName: titanai-scanner # workload identity for cloud access
 restartPolicy: OnFailure
 containers:
 - name: titanai
 image: ghcr.io/titanaisec/titanai:latest
 command: ["python", "agents/conductor.py"]
 env:
 - {name: TITAN_NON_INTERACTIVE, value: "true"}
 - {name: TITAN_FULL_BACKUP, value: "true"}
 - {name: TITAN_STAGED_WORKFLOW, value: "true"}
 envFrom:
 - secretRef: {name: titanai-secrets} # TITAN_LICENSE_KEY, TITAN_LLM_API_KEY
 volumeMounts:
 - {name: reports, mountPath: /app/reports}
 volumes:
 - name: reports
 persistentVolumeClaim: {claimName: titanai-reports}

Alternative: Air-gapped / DMZ / classified (AIRLOCK)

Zero outbound internet. Local LLM only (Ollama). FedRAMP High / SCIF / SECRET / TOP SECRET compliant.

# 1. Transfer TITAN AI installer + all dependencies via physical media
# (we provide a signed offline bundle for enterprise tier)

# 2. Install Ollama locally (one-time)
curl -fsSL https://ollama.com/install.sh | sh # Linux
ollama pull llama3.1:70b-instruct-q4_K_M # pick your model

# 3. Set AIRLOCK env vars, point TITAN at local LLM
export TITAN_AIRLOCK_RUNTIME=true
export TITAN_LLM_BACKEND=ollama
export TITAN_LLM_MODEL=llama3.1:70b-instruct-q4_K_M
export TITAN_LLM_ENDPOINT=http://127.0.0.1:11434

# 4. Run CONDUCTOR normally — it self-enforces no outbound network
python agents/conductor.py

AIRLOCK license: add-on for production. Contact sales for pricing. Trial tier can demo AIRLOCK at runtime via the preflight prompt — same zero-outbound enforcement, just for evaluation.

All Together (one-page cheat sheet)

# 1. Install (license-gated — bundle signed to your org)
curl -fsSL https://titanaisec.com/install.sh | sh -s -- --license TITAN-XXX-XXX-XXX
# Windows: iwr -useb https://titanaisec.com/install.ps1 | iex
cd ~/.titanai # %LOCALAPPDATA%\TitanAI on Windows

# 2. Configure
cp .env.example .env && nano .env # paste your license key + Anthropic key

# 3. Verify (12-point engine integrity check)
python lab/verify-conductor.py # expect: All 12 checks PASSED

# 4. Authenticate Azure (MFA enforced via device code)
az login --use-device-code

# 5. Run
python agents/conductor.py # interactive, asks your preferences

# 6. Review
start reports/ # Windows — open the HTML report
open reports/ # Mac
xdg-open reports/ # Linux

# 7. Apply fixes (only if your tier allows + you approve)
# CONDUCTOR walks you through per-fix consent prompts [y/N]

Support

Email: [email protected]
Web: titanaisec.com
Response SLA: 4 business hours for paid tiers, 1 business day for trial
Emergency rollback help: include logs/conductor-<timestamp>.log + ~/.titan-ai/snapshots/ in your email — we'll walk you through a safe revert.

What TITAN AI actually does