How it works
A pentest is a multi-agent workflow. Specialized agents carry out each stage over your live target. Each stage builds on the captured HTTP traffic from the stage before it.
The five stages
-
Validation and scope. AISafe checks the target configuration and installs a deny-by-default network policy before an agent starts. The sandbox can reach only the exact target origins and extra hosts you allowed.
-
Reconnaissance. Probe agents exercise each target in bounded batches. They record observed HTTP exchanges, group them into operations, and list the specific security questions that testing must answer. The probes respect your excluded paths and rate limits.
-
Testing and coverage. One audit assignment tests each security question. Every assignment ends as covered or uncovered. A covered test cites captured traffic; an unreachable or incomplete test remains uncovered instead of being reported as clean.
-
Triage. A separate agent examines each proven candidate and either promotes or rejects it. AISafe keeps distinct runtime issues separate and projects confirmed evidence into the customer finding.
-
Report. The final stage checks that every planned test has a terminal result, then compiles confirmed findings, evidence, uncovered tests, and remediation guidance.
The whole workflow runs without human intervention. You start the pentest, the agents do the work, and you review the results when they are ready.
Why agents beat scanners
The agents reason about the application's behavior, adapt their approach based on responses, and pursue exploitation paths a traditional scanner would not attempt. They find vulnerabilities that require multiple steps or understanding of the application's specific logic.
Before you start
Configure your target before running: target URLs, optional authentication, custom headers, rate limits, and excluded paths. See Prepare your target.