How agentic pentesting works: planner, workers, tools and evidence

Agentic pentesting is security testing done by an AI agent in a loop. The agent plans, calls tools, reads results and plans again. It works inside rules that a human sets. This page describes Incursion, the testing agent that Excession Labs uses, and makes no claims about how other products are built.

What are the parts of an agentic pentest?#

An agentic pentest has five parts: a planner, workers, tools with rules, notes, and an evidence link for each finding. The walkthrough follows one engagement in order.

What does the planner do?#

The planner turns a scope into a set of tasks. It is the coordinator of the engagement. It decides what to test, in what order, and how to divide the work.

A good plan follows a known test structure. The OWASP Web Security Testing Guide is one common reference for web testing areas such as authentication, session management, authorization and input handling. The planner can use that kind of structure to avoid skipping areas.

The planner works inside the written scope. If a task needs a target outside it, the task does not run. The human operator can change the plan.

What do workers do?#

Workers carry out tasks in parallel. One worker might compare what an anonymous caller and a signed-in caller can request while another reviews client-side JavaScript bundles for endpoints.

Parallel workers do not remove the need for review. Each worker follows the same tool rules and the same evidence rule.

The methods used in an Excession Labs engagement include:

• Direct HTTP requests.
• Browser-observed tests in Chromium, for example CSRF and stored XSS checked in a real browser.
• Review of client-side JavaScript bundles.
• Differential comparison of anonymous and signed-in callers.
• Read-back from a second account to prove cross-account effects.

How do tools and tool rules work?#

A tool is any action the agent can call: an HTTP client, a browser, a code search, a script runner. Every tool has one of three rules.

The operator sets these rules before the run. The safety page lists the full set of safe-test constraints. Human-in-the-loop pentesting shows where approval points fit.

Why does Incursion keep notes?#

Notes let a worker keep what it learned and let the report trace back to the work. Incursion has its own harness with an agent loop, tools and session history. It keeps notes and findings for each worker.

With notes, a worker can continue a task and a reviewer can follow how a finding came about. This page does not describe the internal format.

Why is a task done only when each finding links to evidence?#

The rule keeps unproven claims out of the report. A model can state a vulnerability with confidence and be wrong, so every finding must point at something checkable.

What counts as evidence follows our standard:

• A finding needs evidence of a real effect. A write is proven by reading the changed record back through another session. A bare "success" response is not proof.
• Controls run next to exploit requests: nonexistent identifiers, wrong record types, unsigned or wrongly signed cookies, another account's token, anonymous versus signed-in comparisons.
• Requests and responses are saved with timestamps.
• Labels separate "Observed" (reproduced), "Browser-observed" (shown in a real browser) and inferred paths.

Each finding includes the evidence, the steps to reproduce it, and a suggested fix. AI pentest false positives shows what this rule rejects.

Where does the human review fit?#

People act at three points. The operator sets tool rules and approves actions marked ask. Excession Labs agrees the scope with you in writing. Excession Labs then checks the evidence for each finding and writes the report.

Incursion runs under human control and does not find all vulnerabilities. The report has a "Limitations and open questions" section for what stayed unproven. Where AI pentesting falls short lists the limits.

How it works covers the service workflow from enquiry to retest. The Incursion page describes the tool.