Skip to main content

How it works

A pentest is a multi-agent workflow. Specialized agents carry out each stage, collaborating over your live target. Each stage builds on the previous one, so the testing stage benefits from the scoping and modeling stages' understanding of your application.

The six stages​

  1. Validation. The first agent sends a probe request to each target URL and attempts to follow the authentication flow you described. If the target is unreachable or authentication fails, the run stops with a clear message so you can fix the configuration before wasting time.

  2. Crawling and scoping. A crawling agent walks the application, following links, submitting forms, and recording each endpoint and parameter it discovers. The crawl respects your excluded paths and rate limits, and builds a map of the attack surface within the scope you defined.

  3. Modeling. The agents analyze the crawled surface to identify high-value targets: authenticated endpoints, admin interfaces, routes that accept user input, and flows that handle sensitive data. This prioritization focuses testing where real vulnerabilities are most probable.

  4. Testing. For each candidate vulnerability, an agent crafts a payload, sends the request, and inspects the response. If the response suggests a vulnerability, the agent refines the payload to confirm exploitation and capture proof. It iterates, trying variations until it confirms the issue or rules it out. This covers OWASP Top 10 categories: injection, broken authentication, sensitive data exposure, XSS, SSRF, and more.

  5. Triage. A separate triage agent re-examines each finding's evidence, confirms or rejects it, deduplicates findings that share a root cause, and assigns a confidence score. This pass is what keeps the false-positive rate low.

  6. Report. The final stage compiles confirmed findings, evidence, and remediation guidance into a shareable PDF.

The whole workflow runs without human intervention. You start the pentest, the agents do the work, and you review the results when they are ready.

Why agents beat scanners​

The agents reason about the application's behavior, adapt their approach based on responses, and pursue exploitation paths a traditional scanner would not attempt. They find vulnerabilities that require multiple steps or understanding of the application's specific logic.

Before you start​

Configure your target before running: target URLs, optional authentication, custom headers, rate limits, and excluded paths. See Prepare your target.