What it is

An agent is a program that reasons toward a goal instead of running a fixed script. Give it a target and an objective, "find what an attacker could actually reach here", and it decides what to try next based on what it has already seen: map the surface, form a hypothesis, test it, read the response, revise, move on. Agentic pentesting is that loop pointed at offensive security.

It reasons, it doesn't script: reasoning toward a goal, not a fixed battery of checks

It sits between the two things teams use today. A scanner runs a fixed battery of checks and reports everything that matches a signature, fast, but blind to context and loud with false positives. A human pentester reasons about the specific application and its business logic, slow, expensive, and a snapshot of one week. An agent aims for the pentester's reasoning at closer to the scanner's reach, and leaves the judgment calls to a person.

Why offensive security stalled

Most of security has modernized, continuous integration, cloud, automated defense. Offensive security largely hasn't. It is still delivered mostly as a service, by hand, and it carries three problems that never went away:

Point-in-time. A pentest describes the application as it was the week it was tested. The next deploy can invalidate the report.
Hard to scale. Good testers are scarce and expensive, so depth gets rationed. Many engagements lean on junior or outsourced work and optimize for volume of findings over quality.
Compliance over security. Testing too often becomes a box to tick for an audit rather than an honest attempt to break the system.

The limits of automation so far

Automated tools closed some of this gap for infrastructure, where targets look alike. For web applications they consistently fall short, and the reason is thelast-mile problem: every application is different. The bugs that matter, broken access control, business-logic flaws, chained vulnerabilities, depend on understanding what a specific endpoint is for, which a signature can't encode.

This is the same wall the old DAST category hit: it could flag a pattern, but it couldn't reason about whether the pattern mattered here, or what to do next. So teams kept paying for human testing, not because the tools failed to run, but because they failed to think.

What an agent changes

Language models made the missing piece practical: a system that can hold the context of an application and adapt its testing to it. Used carefully, that turns three things that used to trade off against each other into properties you can have at once:

Continuous instead of annual. Testing can run against each change, so the result tracks the application instead of describing last quarter's version.
Context-aware instead of signature-matched. The agent works from how the application actually behaves, which objects exist, which roles reach them, what a given call is supposed to do.
A short verified list instead of a backlog. The output is meant to be the handful of issues that are genuinely exploitable, with the steps to reproduce them, not thousands of unranked "potential" findings.

How it works

The part that makes this trustworthy is not letting the model improvise freely. In CyberStrike, the agent reasons on top of a deterministic engine that does the work a model is bad at: it ingests every request and response, runs hundreds of rules, builds a cross-identity map of which roles reached which objects and functions, probes injection points, and replays requests under strict safety limits. That engine produces ground truth.

The agent's job is to decide what to pursue, which leads look exploitable, which chain to attempt next, and to narrate why. Evidence comes from the engine, not from the model's imagination, so a finding is backed by real traffic a person can replay. The judgment is the agent's; the facts are deterministic.

What agents still can't do

This is where honesty matters more than enthusiasm. The technology is not finished, and anyone claiming otherwise is selling:

Models hallucinate. A language model will sometimes assert a vulnerability that isn't there. That is exactly why findings have to be tied to reproducible evidence, and why a confident write-up is not the same as a real bug.
Output isn't deterministic. Run the same prompt twice and you can get different paths. Reproducibility has to come from the engine and the recorded traffic, not from the model agreeing with itself.
Safety and authorization are human calls. Scope, rules of engagement, and "is it safe to send this request against production" are not decisions to hand to an autonomous process.

The agent probes, a human decides: human-on-the-loop, not full autonomy

So the realistic model is human-on-the-loop: the agent does the breadth and the grunt work, and a person validates the findings, owns the risky decisions, and stands behind the report. That pairing, not full autonomy, is what's deliverable today.

Where it fits

Agentic pentesting doesn't retire human testers or audit sign-off. It changes what the human spends time on: less rediscovering the same surface every quarter, more validating real findings and making the calls that need accountability. The testing becomes continuous; the person becomes the reviewer rather than the crawler.

That's the whole claim, and it's a deliberately modest one. Offensive security has always been the most direct way to understand real risk. It has just been too slow and too scarce to use everywhere. Narrowing that gap, while being clear about what still needs a person, is the useful version of this technology.

CyberStrike is an AI-augmented penetration testing platform, currently in early access. Want to see the agent and the engine behind it?Explore the platformor join the waitlist.