A pentest that runs every day, not once a year.
Scope it with explicit Rules of Engagement, let an agent work your authorized surface within hard safety bounds, get a grounded VAPT report, and retest after every fix. Safe by construction — every action is gated before it fires, and active exploitation never runs without your sign-off.
authorized & bounded · grounded findings · retest loop · signed
Authorize. Run. Report. Retest.
Scope it (Rules of Engagement)
Authorize exactly what's in scope — hosts, URLs, wildcards — set a request budget and rate cap. Nothing outside your Rules of Engagement is ever touched.
The agent works the surface
A bounded agent tests your authorized targets continuously. Every single action is gated by the runner against your RoE before it fires — the agent proposes, the runner disposes.
Get a grounded VAPT report
A downloadable pentest report — exec summary + every finding with severity, CWE, evidence, and remediation. Grounded: every entry cites the tool that proved it.
Retest after the fix
Re-run the engagement to confirm a finding is actually closed. Continuous, not a once-a-year snapshot that's stale by the time you read it.
Safe by construction, not by promise.
An agent that tests your live systems has to be safe by design. Every action passes the same gate before it can fire — scope, budget, an absolute destructive ban, and the active-exploitation lock.
Deny-all scope, by default
An engagement can only test the targets you explicitly authorize. Out-of-scope is excluded by the Guard, not by the agent's good behavior.
Never destructive
A pentest proves a weakness — it never destroys. Destructive actions are refused absolutely, in every mode, regardless of authorization.
Active testing needs your sign-off
Active exploitation is refused by construction unless you explicitly authorize it and a named human signs the Rules of Engagement. No surprises.
One kill-switch, fail-closed
Halt all autonomous action instantly. A running engagement stops mid-flight; nothing runs while the switch is engaged.
Every decision is signed
Authorization and each run record into a tamper-evident, ed25519-signed ledger. The whole engagement is auditable after the fact.
Reaches what matters
Findings are prioritized by real blast radius — the path to a crown jewel — not a flat list sorted by a scanner's default severity.
It proves the exploit — or it stays a lead.
A scanner flags a pattern; an attacker proves it. The agent upgrades a finding to exploitation-proven only when a benign, machine-checkable demonstration succeeds and a reproducible proof-of-concept is captured. Everything else is reported as a lead — never a false alarm. That's the no-false-positive bar, and your VAPT report shows the captured PoC for every proven finding.
SQL injection
A benign true/false differential reaches the database — proven, without extracting a row of data.
Reflected & DOM XSS
A canary payload reflects, or executes in a real headless browser for client-side sinks.
SSRF — incl. blind
A canary fetch proves server-side request forgery; the blind variant via an out-of-band (OAST) callback.
CORS misconfiguration
The server reflects an attacker Origin with credentials — any site could read authenticated responses.
Server-side template injection
An injected arithmetic expression is evaluated server-side (the product appears, the literal does not).
Open redirect & CRLF
A canary host in a redirect/header param lands in the 30x Location — header-controlled redirect proven.
IDOR / broken object auth
A differential replay returns another tenant's object — broken object-level authorization (BOLA/BFLA).
Benign by construction — canary probes and true/false differentials that extract no data and write nothing. Active exploitation runs only under an explicit, signed authorization.
The deliverable your customers ask for.
"Do you have a recent pentest?" — answer it with a signed, grounded VAPT report that regenerates continuously, never goes stale, and links every finding to its evidence. The agent verifies what detection found; active, exploitation-proven testing runs under an explicit, signed authorization.
Run your first engagement today.
Scope it, run it, get the report — with hard safety bounds and a kill-switch you control.