Cost
Rebuilding requests, switching test accounts and recording responses take time. Automating suitable checks can reduce that effort, particularly when the same application needs testing after several releases.
AI-ASSISTED SECURITY TESTINGAgentic
Agentic
pentesting.
AI agents can carry out repeatable security checks, organise the evidence and follow up on results. A senior pentester sets the scope, investigates the findings and reviews the report.
AITESTING WORKFLOW
01Set the scope
02Run the checks
03Review the evidence
SCOPE → TEST → REVIEW → REPEATWHY AUTOMATESpend less time
Spend less time
repeating the work.
Speed
An agreed workflow can move through repeatable steps without recreating each test by hand. Evidence is captured during the run, so the tester can spend more time investigating results and preparing the handover.
Frequency
Smaller, focused assessments can fit between larger pentests. Teams can revisit a permission change, a set of API routes or a previous finding without reopening the whole application scope.
HOW AGENTIC PENTESTING WORKSA workflow that
A workflow that
responds to results.
An agentic testing system uses an AI model to select a testing step, call an authorised tool and inspect the result before choosing what to do next. Depending on the implementation, that could involve a browser, an HTTP client, API documentation and recorded test cases.
An agent can maintain the test context, move between accounts and requests, and collect evidence across a sequence. Permissions, request limits and approval points determine how much the workflow can do on its own.
Agree the target
Choose the application, endpoints, roles and business flows. Record the testing window, permitted actions and any systems to exclude.
Prepare the access
Set up accounts, synthetic records and the tools required for the checks. Confirm how successful login and expected access decisions will be recognised.
Run and collect
The workflow performs the agreed checks and records requests, responses and relevant actions. Failed authentication, blocked paths and unexpected behaviour need review.
Investigate and report
A tester reproduces candidate findings, checks their impact and documents remediation. The report also records completed checks and gaps in coverage.
CHOOSE THE COVERAGEStart with what
Start with what
needs checking.
These examples show how an assessment can be scoped. The final check set depends on the application, access and tooling agreed for the engagement.
EXAMPLE SCOPE
An authenticated web application
A defined set of screens and workflows, with test accounts for the roles that need comparing.
Automation can handle
Navigation, repeatable requests, account switching and response comparison across the agreed workflows.
Tester focus
Business rules, unexpected access, exploitation impact and the reproduction of findings.
COST & TURNAROUNDPut automation where
Put automation where
it saves the most work.
What affects the price
A focused assessment of selected APIs or a repeatable permission check needs a different amount of work from a broad investigation of an unfamiliar product. Reusing agreed checks across releases is where automation can save substantial manual effort.
The quote needs to include initial setup, tool and model usage, investigation and reporting. The balance changes with the number of roles, the complexity of authentication and the amount of manual follow-up.
Tell us your scope and budget ↗01
Setup
Targets, accounts, test data and workflows.
02
Automated execution
Repeatable checks and evidence collection.
03
Investigation & review
Validate the findings and document the fixes.
Shorter repeat cycles.
Once access and workflows are prepared, automated steps can be repeated with less manual setup. Turnaround still includes reviewing results and writing the report. Agree delivery dates against the actual scope.
PICK THE APPROACHMatch the method
Match the method
to the application.
| Approach | Manual pentesting | Automated scanning | Agentic pentesting |
|---|---|---|---|
| How it works | A tester explores and adapts the assessment. | A tool runs configured checks. | An AI workflow selects steps and uses authorised tools. |
| Useful for | Complex logic, integrations and exploratory testing. | Known vulnerabilities and configuration checks. | Defined web/API workflows and repeat assessments. |
| Human effort | Direct investigation throughout the test. | Setup, triage and validation of results. | Setup, supervision, investigation and validation. |
| Cost drivers | Time, depth, roles and application complexity. | Asset count, tooling and result review. | Workflow setup, model/tool use and review effort. |
A hybrid engagement can combine repeatable agentic checks with manual investigation of sensitive workflows. That balance can be set in the proposal.
THE HANDOVERFindings, evidence
Findings, evidence
and remediation.
Agree the report contents before testing. An agentic assessment can document:
01
Coverage: completed, blocked and omitted checks.
02
Evidence: affected roles, requests, responses and observed impact.
03
Findings: reviewed severity, reproduction steps and fixes.
04
Retesting: the conditions used to verify each fix.
Sample PDF: a fictional web application and API assessment.
RUNNING THE ASSESSMENTClear permissions.
Clear permissions.
Recorded actions.
Target boundaries
Authorised hosts, accounts and actions are specified before testing. Rate limits, spending limits and a way to stop the workflow belong in the operating setup.
Data handling
Agree which documents, requests or logs may reach an external model provider. Synthetic records help keep customer information out of the test data.
Human review
Unexpected behaviour, sensitive actions and candidate findings need a named reviewer. The activity record should show the action performed, its result and any approval.
Further reading: OWASP Autonomous Penetration Testing Standard ↗
QUESTIONSBefore you
Before you
request a quote.
What is agentic pentesting?
It is penetration testing that uses AI agents to coordinate parts of the assessment. The agent can choose a permitted step, use a tool and evaluate the result. The scope defines its access and autonomy; human review checks the findings.
Is agentic pentesting cheaper?
It can be, especially when a check set can be reused across releases. Setup, application complexity and manual review affect the total. A quote should state the coverage and include those costs.
How much faster is it?
Automated steps can reduce time spent repeating requests and collecting evidence. The overall turnaround also depends on access, failures that need investigation and report review. The delivery schedule is agreed after scoping.
Can it replace our manual pentest?
That depends on the required coverage. Complex business logic, unusual integrations and broad exploratory testing can need substantial manual work. A hybrid scope may cover repeat checks with automation and reserve manual time for those areas.
Does our product need AI features?
No. Agentic pentesting describes how the testing is performed. It can assess conventional web applications and APIs. Testing the security of an AI-powered product is covered by our AI application security service.
What do you need to scope the work?
Application URLs or API documentation, the workflows to test, the number of roles and organisations, the authentication method and your deadline. Tell us the budget and any customer reporting requirements so we can assess a suitable scope.
Let's talk scopeWhat do you
What do you
need tested?
Tell us about your application, infrastructure or upcoming deadline. We’ll work through the scope with you and put together a proposal.
ping [at] azacus.io ↗Prefer a call? 0131 287 7869
Please don’t include credentials or sensitive testing data here.