Scope, target and dates
The nominated application, environment, agreed scope and testing window.
Agentic penetration testing
Find the weaknesses an attacker can reach in your running application.
We discover the reachable surface of an application you nominate, run scoped automated testing, then have multiple agents test it. Findings are reproduced where possible, consolidated and reviewed by a human before they reach the report.
Agentic testing. Human-reviewed findings.
The process
From a URL to reviewed findings
One engagement moves through five defined stages: the application you nominate is discovered and crawled within the written scope, scoped automated testing runs against the discovered surface, multiple agents test the agreed targets, and a human reviewer confirms or dismisses every candidate finding before the report is approved.
Explore both methodologies
Report preview
Evidence your engineering team can act on
A synthetic example of a confirmed finding. It illustrates the reporting format, not a customer outcome or a promise of findings.
Penetration testing report
Illustrative example - not a customer result
- Target
- staging.example.test
- Scope
- Account export workflow
- Access
- Authenticated, by agreement
Finding PT-EXAMPLE-001
Cross-account access to an export
High
Reviewed and approved by a human reviewer
Evidence and reproduction
- Sign in as the agreed test account for tenant A.
- Request the export endpoint using the identifier of the agreed tenant B test account.
- The response returns tenant B's export despite the caller belonging to tenant A.
Severity rationale
The observed response exposes another tenant's data to an authenticated user outside that tenant.
Remediation
Enforce tenant-scoped authorisation before returning the export and add a cross-tenant access regression test.
Illustrative request and response
Synthetic identifiers and data only. The request uses tenant A's agreed test session; session details are omitted.
GET /api/exports/export-tenant-b HTTP/1.1
Host: staging.example.test
HTTP/1.1 200 OK
Content-Type: application/json
{"tenant":"tenant-b","export":"synthetic test data"}- Expected behaviour
- Reject cross-tenant access without returning tenant B's export.
- Observed in this example
- The request succeeds and returns tenant B's data to tenant A's test session.
Example coverage and limitations
The agreed export workflow and test accounts only. Other endpoints and unauthenticated access are not assessed in this example. This excerpt does not represent a complete assessment of the application.
The deliverable
One human-approved report
The deliverable is a reviewed assessment, not a feed of agent output. Confirmed findings connect evidence and reproduction steps to remediation guidance, with the nominated target, agreed scope, testing dates, coverage and limitations recorded.
Reproduced findings
Each confirmed finding carries the requests and responses that demonstrate it, and the steps to reproduce.
Final severity and rationale
A human reviewer sets severity and records the reason for every decision.
Remediation guidance
Practical guidance for each confirmed finding, for the engineering team.
Coverage and limitations
What was tested, what was not, and why.
Retest outcome
One retest of reported findings within 60 days of the report, with the result recorded.
When to use it
For an application that needs an outside view before it is exposed
Before a release or migration
Test the environment that will go live, before customers reach it.
Before a customer or partner review
Give an enterprise customer a reviewed report tied to a named target and date.
After a change to authentication or access control
Confirm that new roles, flows or integrations behave as intended under attack.
Boundaries
Agreed scope. Agreed access. Captured evidence.
Written scope and consent
Target, environment, permitted testing and exclusions are agreed before any traffic is sent. Production requires explicit agreement.
Agreed access
Unauthenticated by default. Authenticated testing uses test accounts you provide for each role; credentials are not retained in findings or reports.
Captured evidence
The requests sent and responses received, kept for the retention period agreed in writing, then deleted.
Where it runs
LAN10-hosted, or inside your own cloud account or servers using your approved AI services.
Never performed: denial of service, destructive actions, exploitation involving real customer data, and social engineering.
Common questions
Scope a penetration test
Tell us the application, the environment you would like tested and why. We will agree a written scope and provide a quote.
Request a scoped engagementHuman-reviewed findings on every engagement