Trusted by security teams at

What is automated penetration testing?

Software that runs the pentest for you. The older generation replays a fixed checklist of known attacks. The newer generation uses AI agents that read the target, chain weaknesses, and prove impact the way a human tester would.

Two generations of automation

Both run without a human driving each step. They produce very different evidence.

Scripted scanners

Replay signatures against known weakness patterns. Fast and cheap, but blind to logic flaws and heavy on false positives.

AI agents

Reason from each response, chain weaknesses into attack paths, and save the exact request that proved the bug.

The difference: evidence

A scanner flags what might be wrong. An agent shows a working exploit, so triage starts from confirmed risk.

What continuous automation buys you

When testing is automated, cadence stops being the bottleneck.

Every deploy tested

Agents run in CI/CD and on pull requests, so new code is attacked before it reaches production.

Fixes, not PDFs

Each finding ships with a merge-ready fix PR and is retested after the merge.

Full-stack scope

Code, APIs, web apps, infrastructure, and cloud, covered by one agent instead of five tools.

Runs inside your perimeter

Open-source and self-hostable with your own LLM, so targets and findings never leave your network.

Automated pentesting: scanner vs autonomous agent

How signature-based automation compares to agents that exploit and validate.

Capability

Strix agents

Scripted scanner

How it works

Reasons from responses, chains exploits

Replays a fixed signature checklist

Business logic flaws

yes

no

Proof per finding

Working exploit and request

Pattern match

False positives

Low: validated before reporting

High: manual triage required

Remediation

Merge-ready fix PR

Finding description

Runs in CI/CD and pull requests

yes

varies

Open-source and self-hostable

yes

rare

Best for

Continuous, validated offensive testing

Quick baseline hygiene checks

How it works

Strix agents

Reasons from responses, chains exploits

Scripted scanner

Replays a fixed signature checklist

Business logic flaws

Strix agents

yes

Scripted scanner

no

Proof per finding

Strix agents

Working exploit and request

Scripted scanner

Pattern match

False positives

Strix agents

Low: validated before reporting

Scripted scanner

High: manual triage required

Remediation

Strix agents

Merge-ready fix PR

Scripted scanner

Finding description

Runs in CI/CD and pull requests

Strix agents

yes

Scripted scanner

varies

Open-source and self-hostable

Strix agents

yes

Scripted scanner

rare

Best for

Strix agents

Continuous, validated offensive testing

Scripted scanner

Quick baseline hygiene checks

From issue to fix in seconds

Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847

SSRF via URL Parameter in /api/proxy

OpenHigh · 8.6CWE-918

TL;DR

The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact

Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location

acme/api · proxy-handler.ts:23

GET/api/proxy?url=

Severity

High

CVSS

8.6

Fix Effort

Low

Discovered

2h ago

Discover & Validate

Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction

How do I fix it?

Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy

23	23	const targetUrl = req.query.url;
24		const resp = await fetch(targetUrl);
	24	const parsed = new URL(targetUrl);
	25	if (!ALLOWED_HOSTS.has(parsed.hostname)) {
	26	throw new ForbiddenError("blocked");
	27	}
	28	const resp = await fetch(parsed.href);
25	29	return res.json(await resp.json());

✓Fix verified — vulnerability no longer exploitable

→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix

Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Frequently asked questions

Common questions about automated penetration testing.

Automated penetration testing is security testing run by software rather than a human consultant. Modern approaches use AI agents that enumerate the attack surface, chain vulnerabilities, and exploit them to prove real impact, producing a working proof-of-concept per finding.