# AI Pentest Services

> Penetration testing of web applications and APIs with Incursion, the Excession Labs testing agent. Findings are reproduced with evidence before they reach your report.

AI Pentest Services is operated by Excession Labs (https://excessionlabs.ai). Contact: support@excessionlabs.ai. Excession Labs tests only systems whose owner has given written authorization.

Every page is also available as Markdown: add `index.md` to the page URL.

## Key pages

- [About AI Pentest Services](https://aipentestservices.com/about/index.md): AI Pentest Services is run by Excession Labs, which builds Incursion, a terminal AI agent for authorized security testing of web apps and APIs.
- [AI vs manual pentesting: what each does best](https://aipentestservices.com/ai-vs-manual-pentesting/index.md): AI vs manual pentesting in one table: which task types suit an agent, which need human judgment, and how Excession Labs combines both in one test.
- [Contact us about AI-assisted pentesting](https://aipentestservices.com/contact/index.md): Contact AI Pentest Services about AI-assisted penetration testing of your web application or API. We reply by email to agree scope, access and a test window.
- [AI pentest example: a worked assessment of a demo e-commerce API](https://aipentestservices.com/example-assessment/index.md): AI pentest example on a fictional API: the written brief, tool rules, coordinator and workers, one validated finding, one rejected false positive and a retest.
- [AI pentesting guides](https://aipentestservices.com/guides/index.md): Guides on AI-assisted penetration testing: how agents test web apps and APIs, how findings are validated, where AI falls short, and how to judge results.
- [How AI penetration testing works, step by step](https://aipentestservices.com/how-it-works/index.md): How AI pentesting works in nine steps, from scoping call to retest: written authorization, planner and workers, tool rules, evidence checks and the report.
- [Incursion: the AI agent behind our pentests](https://aipentestservices.com/incursion/index.md): Incursion is the terminal AI agent behind our pentests. See how its coordinator, workers, tool rules and evidence standard work in authorized testing.
- [AI penetration testing for web applications and APIs](https://aipentestservices.com/index.md): AI-assisted penetration testing of web apps and APIs with Incursion, the Excession Labs agent. Every finding is proven with evidence before it reaches you.
- [Start an AI pentest pilot](https://aipentestservices.com/pilot/index.md): Apply for a free AI pentest pilot of your web app or API. Small written scope, written authorization, and every finding in scope with evidence and a fix.
- [AI pentest pricing: what changes the quote](https://aipentestservices.com/pricing/index.md): AI pentest pricing: we quote after scoping, with no price list. Six factors change the quote: apps, roles, API size, environments, deadline and retests.
- [Privacy notice](https://aipentestservices.com/privacy/index.md): What AI Pentest Services collects when you visit or send a request, why, where it is stored, how long we keep it and how to contact Excession Labs about your data.
- [Is AI pentesting safe? Our limits and stop rules](https://aipentestservices.com/safety/index.md): Is AI pentesting safe? How our tests stay inside scope: allow, ask and deny tool rules, test-owned data, bounded tests, stop conditions and production limits.

## Services

- [Per-release penetration testing after meaningful releases](https://aipentestservices.com/per-release-testing/index.md): Pentesting after each release: scope only the delta, retest earlier findings and get a report with evidence for that release. No fixed cadence is promised.

## Guides

- [AI pentest agents vs DAST scanners: what each does and what neither replaces](https://aipentestservices.com/guides/ai-pentest-agents-vs-dast-scanners/index.md): AI pentest vs DAST: how a fixed-check scanner and an adaptive agent differ, what each finds, a comparison table and a seven-step way to test both on one build.
- [AI pentesting false positives: why agents over-claim and how to validate](https://aipentestservices.com/guides/ai-pentesting-false-positives/index.md): Why AI pentest agents report bugs that are not real, the evidence standard that stops it, and a validation checklist you can apply to any AI-generated finding.
- [AI pentesting for startups: when it fits and what to prepare](https://aipentestservices.com/guides/ai-pentesting-for-startups/index.md): AI pentest for startups: when AI-assisted pentesting fits a customer security review or launch, a readiness checklist to prepare, and what it will not give you.
- [Evaluating an AI pentest report: signs of real validation](https://aipentestservices.com/guides/evaluating-an-ai-pentest-report/index.md): How to evaluate an AI pentest report: check for requests, read-back proof, controls, evidence labels and limits. Includes a scorecard with no numeric scores.
- [How agentic pentesting works: planner, workers, tools and evidence](https://aipentestservices.com/guides/how-agentic-pentesting-works/index.md): How agentic pentesting works: a planner splits work, workers run tasks in parallel, tool rules gate actions, and each finding must link to evidence.
- [How AI agents test authorization: differential tests across accounts](https://aipentestservices.com/guides/how-ai-agents-test-authorization/index.md): How an AI pentest agent tests your app for IDOR and broken authorization: replay requests across accounts, compare responses, and prove the effect by read-back.
- [Human-in-the-loop pentesting: approval rules for AI agents](https://aipentestservices.com/guides/human-in-the-loop-pentesting/index.md): Human-in-the-loop pentesting: set allow, ask and deny rules for an AI agent, decide which actions need approval, and where people review. Includes a rule table.
- [Is AI pentesting safe in production? Rules, limits and a checklist](https://aipentestservices.com/guides/is-ai-pentesting-safe-in-production/index.md): Is AI pentesting safe in production? Limits for destructive actions, data, request rate and third-party cost, plus tool rules, test data and stop conditions.
- [Pentesting in CI/CD: which releases should trigger a test](https://aipentestservices.com/guides/pentesting-in-ci-cd/index.md): Pentesting in CI/CD: which releases need a test, how to test on staging, how to send scope deltas and how to retest fixes. Includes a release trigger table.
- [Testing signed-in flows with AI agents: accounts, sessions and MFA](https://aipentestservices.com/guides/testing-signed-in-flows-with-ai-agents/index.md): Authenticated penetration testing with an AI agent: test accounts per role, session handling, MFA and SSO options, and why real user credentials stay out.
- [What is AI penetration testing? Three kinds, and what each can do](https://aipentestservices.com/guides/what-is-ai-penetration-testing/index.md): What is AI penetration testing? It covers AI-enhanced scanners, autonomous agents and AI-assisted humans. See what each does and where it stops.
- [Where AI pentesting falls short: limits you should know before you buy](https://aipentestservices.com/guides/where-ai-pentesting-falls-short/index.md): AI pentesting limitations: business context, novel chains, unwritten authorization rules, fragile systems, social tests, nondeterminism, and how we handle each.

## Related Excession Labs sites

- [penetrationtestservices.com](https://penetrationtestservices.com/llms.txt): Web application, API and SaaS penetration testing
- [airedteamingservices.com](https://airedteamingservices.com/llms.txt): Security assessments of LLM apps, RAG and AI agents
- [pentestcompare.com](https://pentestcompare.com/llms.txt): Sourced comparison of pentest providers

## Optional

- [Full text of this site](https://aipentestservices.com/llms-full.txt)