Skip to main content
Snapsec empowers Penetration Testers by automating repetitive reconnaissance and vulnerability validation while providing deep control over assessment scope, methodologies, and evidence verification.

​
1. Scoping an Assessment

  1. Navigate to AI Pentesting > Projects & Assessments.
  2. Click New Assessment and choose the assessment type:
    • External Perimeter: Reconnaissance and exploitation against public IP/domain scopes.
    • Web Application & API: In-depth testing of authentication, business logic, injections, and CSRF/CORS.
    • Internal Network: Lateral movement and privilege escalation simulations.
  3. Define the explicit scope: specify in-scope URLs/CIDRs and strict out-of-scope targets.

​
2. Safety Controls and Guardrails

To prevent unintended disruption to production workloads:
  • Configure Rate Limits: Cap requests/sec (e.g., 20 req/s).
  • Set Exclusion Patterns: Exclude destructive paths (e.g., /admin/delete-database, /logout).
  • Enable Human-in-the-Loop Mode: Require analyst authorization before executing exploit payloads that modify state.

​
3. Reviewing Proof-of-Concept Evidence

Every finding generated by the AI Pentesting engine includes verifiable proof:
  • Exact HTTP Request and Response headers and bodies.
  • Command execution output or injected payload traces.
  • Step-by-step reproduction guide so developers can reproduce the issue locally.

​
4. Automated Retesting

Once the engineering team submits a fix:
  1. Open the assessment finding.
  2. Click Verify Fix (Retest).
  3. The AI agent replays the exact test vector against the target and validates whether the vulnerability is remediated or still exploitable.