Autonomous penetration testing: what runs alone and what needs a person

Autonomous penetration testing is a pentest in which AI software plans and runs some or all of the testing steps with little human input. Vendors define it as a full lifecycle at machine speed. Few say where it stops. This guide gives a working definition, a table of tasks by autonomy level, the risks, and a checklist to judge a vendor.

What does autonomous mean in a pentest?#

Autonomous means that software chooses the next action without a person approving it. In a pentest, that covers recon, request crafting, reading responses and deciding what to try next. It does not tell you whether a person set the scope, approved risky actions or checked the findings.

Autonomy is a spectrum with at least four points:

1. Assisted: a person drives and the software suggests.
2. Supervised: the software acts, and a person approves each risky step.
3. Bounded autonomy: the software acts alone inside written limits, and a person checks the results.
4. Unbounded: the software acts with no limits and no review. No responsible provider should sell this for a live system.

Our position is at the third point. We do not call our agents autonomous without human control. Excession Labs agrees the scope with you in writing, sets a tool rule for each scope, checks the evidence for each finding and writes the report.

Public examples show the state of the field. XBOW wrote that "an autonomous penetration tester has reached the top spot on the US leaderboard" on HackerOne, and also that its security team reviewed the findings before submission to comply with HackerOne's policy on automated tools (blog dated 24 June 2025). That claim is for the US leaderboard only. Even the headline example had a person in the loop.

How do autonomy levels compare, task by task?#

The table shows where each task usually sits. It is a design we recommend, not a standard.

These are the allow, ask and deny rules described in human-in-the-loop pentesting.

What can agents do alone?#

Agents run repetitive, read-heavy work well. Examples are mapping endpoints from an OpenAPI file, sending the same request as each role, and comparing the results. They also run in parallel. One agent can test each role while another reads the client bundle.

A finding from this work still needs proof. For a write, the proof is a read-back through a second session. Controls run beside the exploit request: a nonexistent ID, a wrong record type, another account's token. How agentic pentesting works describes the planner and workers.

Benchmarks give a limited view. In DARPA's AI Cyber Challenge final, teams found 54 of the 63 challenge synthetic vulnerabilities and patched 43 (DARPA, 8 August 2025). Those tasks test code analysis, so they say little about authorization flaws or business logic in your app.

What still needs approval or a person?#

Anything with a side effect, and anything that needs knowledge of your business. A write, a delete, a bulk email or a paid API call can cost money or change data. An agent cannot know which actions you allow unless the scope tells it.

People also decide three things that software does poorly:

• Whether a result breaks a business rule that only your team knows.
• Whether a finding has a real effect or is a misleading success response.
• How to rate severity and describe the fix.

The where AI pentesting falls short guide lists these limits in full. If something outside the scope looks relevant, the right move is to stop and ask.

What are the risks of autonomous pentesting?#

The main risks are scope drift, side effects, cost and false findings. Each has a control.

Is AI pentesting safe in production? covers the production rules.

How do you judge an autonomous pentest vendor?#

Ask questions whose answers you can check. Edgescan's view is that some AI pentesting is expensive vulnerability scanning. Use these questions to tell the difference.

Treat claims of "all vulnerabilities", "no false positives" or "fully hands-free" as red flags. No test finds all vulnerabilities. Evaluating an AI pentest report shows how to read the output.

Where do we sit?#

We combine tool rules with a human evidence check. The lab's AI agents do the repetitive testing work under rules agreed in the scope. Excession Labs checks the evidence for each finding and writes the report. Methods include direct HTTP requests, browser-observed tests, review of client-side bundles and differential comparison of anonymous and signed-in callers.

The rules differ by scope, and they can be tighter for production. We publish no turnaround times, prices or benchmark scores for our agents. How it works lists the nine steps. The pilot page explains how to apply for a small, scoped test.