An agent that makes the plan for the attack and shows the proof for each finding
The SecureGraph autonomous pentest agent uses the same method as a senior tester. It does recon, makes a decision, acts, continues along the path, does a check, and writes the report. It operates in the agreed scope and in an isolated container. It never promotes a result without proof.
The AI makes plans. The engines measure. Actions that change a system need approval Findings stay in your database
34
phases in the method
23
asset types
129
tools in the catalog
26
classes for verification
A test each year, but code each day
A test that occurs one time each year cannot see the code that you released last week. You can start the agent on demand, or continuously. Thus, tests keep pace with your pipeline.
A person uses one path at a time
A human tester uses one path and then stops. The agent does systematic tests and instinctive tests together. Then it continues along the paths with the best result.
Findings, not noise
Breadth has no value without proof. A candidate finding must pass verification before it goes into your report, your risk register, or your board papers.
One loop, from scope to proof
The agent keeps a visible plan. It moves through a phase method that agrees with the asset type. It makes a new plan after each tool result.
Scope
You agree the scope of the engagement one time. The scope cannot change after creation. The agent does a check of each action against the scope before a tool operates.
Recon
The agent maps the surface: domains, hosts, ports, APIs, JavaScript bundles, captured traffic, and specification files. Dead hosts never go into the map.
Plan
The agent makes a threat model. It selects a phase plan for the asset type. It keeps a visible plan and a list of tasks during the work.
Action
The agent uses tools, writes probes, continues along a path, and connects findings. Deterministic specialist sweepers do checks of full vulnerability classes at the same time.
Check
An independent adversarial verifier does a test of each candidate finding again with read-only tools. Only confirmed findings go forward.
Report
Verified findings go into your risk register with the captured evidence and a proof of concept (PoC). Unverified probes stay in an appendix.
What the agent finds
The agent goes past known-CVE matching. It looks for design faults and logic faults that a signature scanner never sees. It connects these faults into real attack paths.
Business logic
- Broken access control in multi-role flows
- IDOR across hidden API paths
- Workflow manipulation and payment abuse
- Race conditions
Access control
- Broken object-level authorization (BOLA)
- Broken function-level authorization (BFLA)
- Absent or incorrect authorization
- Incorrect authentication
Injection and execution
- SQL injection
- Cross-site scripting (XSS)
- Command injection and code injection
- Insecure deserialization and request smuggling
Server side and trust
- SSRF and cloud metadata paths
- Path traversal and host confusion
- Gaps in signature verification
- Fail-open logic
Secrets and cryptography
- Hardcoded secrets
- Weak cryptography
- TLS misconfiguration
- Certificate faults
Misconfiguration
- Security headers and browser hardening
- Unsafe file upload
- Information disclosure
- Exposed services and resources
Attack chains
- Multi-step paths across endpoints
- SSRF, then metadata, then credential theft
- IDOR, then privilege escalation
- JWT forgery, then account takeover
AI application risk
- Prompt injection and jailbreak classes
- Indirect prompt injection
- Abuse of multi-step AI workflows
- Tests of the model boundary and the agent boundary
Coverage includes the OWASP Top 10 and the OWASP API Security classes. The product declares each category that is not testable from the external surface of a target. It does not give false data.
If a finding is not verified, it does not go into the report
An autonomous agent that a person cannot check is a risk. Thus, verification is a stage of the run. It is not a note at the end of the run.
- Independent adversarial verifierA different verifier does a test of each candidate again with read-only tools. A strict limit on turns and time applies. The verifier gives one of three results: confirmed, rejected, or inconclusive.
- Concurrent finding managerSecureGraph does a check of findings at the time of discovery. A confirmed finding goes into the risk register immediately. It does not wait for the end of the run.
- A reversible authority ladderThe AI can promote a finding only at high confidence and with no hallucination flag. Each evidence string must also be present in the stored data. The deterministic result always stays on the finding.
- Negative controlsThe benchmark set includes targets that are known to be safe. Thus, SecureGraph measures false positives, not only false negatives.
Verified findings only
This rule controls the report pipeline: only auto-verified findings and human-verified findings go into executive content. All other results stay in an appendix.
You select the quantity of control for the model
Autonomy is a dial. It is not a switch. Deterministic specialist passes stay on at each level as a safety net.
Level
Low
Guard-railed. Pre-loop scaffolding, a turn limit for each phase, and an idle stop. Use this level when the agent must stay on a fixed route.
Level
Medium
The default level. Recon occurs first. Then the model makes a plan and acts within turn limits. This level gives depth and control together.
Level
High
Model-led and long. No forced phase advance and no turn limit. The model controls the route and the depth. The run stops only at a hard stop.
Autonomy with a leash
The agent is powerful because it has limits. Each capability is declared. A person can check each action. SecureGraph keeps a record of each decision.
Container isolation
Each session operates in a temporary container. The agent never gets a host shell.
No direct database access
The runner has no database client. Data comes only through engine interfaces.
Scope that cannot change
The scope is fixed at the start of the engagement. The guard refuses an action outside the scope.
Approval gates
Authentication, package installation, and each action that changes the state of a system wait for human approval.
Capability attestation
Network egress, process execution, and credential use are declared capabilities. Each capability has a named guardrail.
Prompt guard and ledger
The agent treats tool output as untrusted. SecureGraph keeps a record of each decision, each action, and each finding.
Budgets and hard stops
Limits on turns, tools, and session time apply. A paused session cannot extend a hard stop.
Authorized tests only
You agree the scope and you hold the right to do tests of the targets that you connect. We supply the controls.
A surface is never complete
New endpoints, new releases, and new corrections occur continuously. The agent keeps pace with your release speed. It does not do one test each year.
Models and your data
- Provider-agnostic routerA primary reasoning model operates with an automatic fallback if the provider fails.
- Personal data removed firstThe router removes personal data from a prompt before a call to an external provider.
- Findings stay in your databaseThe results go only into your security database with your other evidence.
- Prompt versions and auditSecureGraph versions each prompt. It audits each AI action.
The limits, stated plainly
Trust the claim that you can check. These are the limits of the current product.
Not a fully autonomous hacker.
The agent can make a plan for a full chain. But actions that change the state of a system, and authentication steps, need approval.
The agent never invents a finding.
The AI does a check of the results from the engines and explains them. It never invents a finding or changes a risk score.
No guarantee of zero false positives.
Verification removes noise. The product tells you the limits that remain. Heuristic probes never go into a severity roll-up.
No bug-bounty swarm.
There is no group of unsupervised bots. The specialists are deterministic sweepers and a governed model loop.
The product states coverage correctly.
Some risk categories are not testable from the external surface of a target. The product declares these categories. It does not give false data.
Continuous agent schedules are in development.
VAPT campaigns and continuous reassessment have schedules. Recurring scheduled agent engagements are a research task.
What customers ask first
Is this a scanner with an AI on top?
No. The agent controls the offensive loop: recon, decision, action, continue the path, check, report. It operates a large tool catalog from an isolated container. Deterministic specialist sweepers give breadth and do not use model turns. An independent verifier does a check of the work. The model makes plans. The engines measure.
Can the agent act without a person?
The agent does read-only tests autonomously. Authentication, package installation, and each action that changes the state of a system wait for approval. This rule is deliberate. An important action needs an initiator and, when configured, an authorizer.
Can the AI report an incorrect finding?
SecureGraph does a check of findings. It does not write findings. An independent adversarial verifier must confirm a candidate finding before the finding goes forward. The deterministic result always stays on the finding, so each AI decision is reversible. Unverified probes stay in an appendix.
Where do the results go?
The results go into your security database with your inventory, risk, and evidence. Model calls go through a provider-agnostic router. The router removes personal data before a call to an external provider.
How does an agent run agree with my release cycle?
Use three methods. Use an engagement for depth. Use continuous DAST cycles that probe only new or changed endpoints. Use a limited run from CI for a commit or a pull request. Remediation replay does a test of a fix and gives one of three results: fixed, still vulnerable, or inconclusive.
What is the cost?
The Autonomous Pentest Agent is included on the Starter, Growth, and Enterprise plans. AI work is credit-metered. It is not available on the Free plan.
Use the agent on your scope
Bring a target and look at the loop: recon, plan, action, check. We will show you the guardrails and the verification gate in the live product, not in a slide.