AI SECURITY AGENTS
Eight specialised agents share the crawl and attack your app from different angles. Stealth agents go first, aggressive ones follow, and results are deduplicated into one finding list.
The agent team
| Agent | Focus | Style |
|---|---|---|
| Web Reconnaissance Scout | Maps surface area via crawling, fingerprinting, and subdomain enumeration. | Balanced |
| Injection Vulnerability Hunter | SQLi, XSS, command injection, template injection. | Aggressive |
| Authentication Analyzer | Auth bypass, weak credentials, session fixation, JWT weaknesses. | Aggressive |
| API Security Prober | REST and GraphQL endpoints for IDOR and mass assignment. | Balanced |
| Configuration Auditor | Headers, TLS, exposed config files, directory listing. | Stealth |
| Business Logic Tester | Flow bypass, privilege escalation, race conditions. | Balanced |
| SSRF & Path Traversal Crawler | Server-side request forgery and path traversal. | Stealth |
| Compliance Risk Assessor | GDPR, PCI-DSS, cookie policy, and data-exposure risks. | Stealth |
Each agent card on the Agents page lists its specialties, tactics, average duration, and average findings.
How a run is coordinated
- Select agents — the enabled set is used for every scan in your organization.
- Parallel execution — stealth agents run first to complete reconnaissance without tripping defences; aggressive agents follow.
- Coordinated results — findings are deduplicated and correlated across agents so one root cause produces one finding with related findings linked.
Enabling and disabling
Toggle any agent on its card, or use Enable All / Disable All. The header shows the estimated total duration and expected findings for the current selection.
Editing an agent profile
Open an agent to see its JS Profile — the script that drives its behaviour. You can edit and save it (an Unsaved changes indicator appears while editing). Custom scan scenarios in JavaScript are a Pro and Lifetime feature; keep a copy of the default before making large changes.
COMMON QUESTIONS
SEE IT ON YOUR OWN APP
Docs explain the product. A scan shows you what it finds on your deployed URL — keys, RLS, auth, and API gaps in under 60 seconds.
14-day free trial · No credit card · Cancel anytime
