Methodology, Scope & Coverage
How does an AI Pentest work, and who is behind the methodology?
An AI Pentest is a code-driven, on-demand penetration test of a single web application, executed by Intruder's autonomous AI agents. Because it focuses strictly on a single web application rather than your broader infrastructure or external network, it is fast and focused enough to run with every major release instead of just once or twice a year.
The methodology is distilled directly from Intruder's in-house security team, whose qualifications include CREST certifications and the Offensive Security Certified Professional (OSCP). Intruder is a CREST member company, holds SOC 2 Type II compliance and Cyber Essentials, and was selected for the UK government's GCHQ Cyber Accelerator. Our AI agents apply the same methods as human testers by sending requests, analyzing responses, and validating findings by demonstrating exploitation against your live environment. Full details can be found in the About Intruder appendix of every report.
Does it guarantee that every line of code is tested?
In practice, no penetration test (human or AI) can guarantee that every single line of code is read or that every piece of functionality is exhaustively tested without infinite time and budget. What we do guarantee is that we identify every piece of functionality in your application using your source code and test all of them with a high degree of coverage (varying slightly only for extremely large applications). Because the AI pentest agent is exploratory and non-deterministic, adapting its actions to what it discovers, specific actions may differ from one execution to another, and as with any pentest, we always recommend validating findings before remediation.
What does an AI Pentest cover?
It is a comprehensive web application penetration test, run both unauthenticated and (if you supply credentials) authenticated. By default, the scope covers the target identified in your order (along with the domains, services, or resources it depends on for normal function) across the OWASP Top 10 and beyond:
Category | What We Look For |
Authentication & Session Handling | Weaknesses in login and session mechanisms that could allow an attacker to:
|
Authorization | Flaws in access control mechanisms that could allow an attacker to:
|
Business Logic | Weaknesses in the mechanisms enforcing core application business logic, such as:
|
Input Validation & Code Injection | Areas where a user can introduce their own code and influence application behavior for themselves or other users, including:
|
File Uploads | Weaknesses in file upload functionality that could allow an attacker to:
|
Information Leakage | Areas that unnecessarily disclose internal implementation details, such as:
|
Server Configuration | Server configuration settings that may reduce the security of the server and application, such as:
|
What is out of scope or prohibited?
Missing Source Code: Because the test is code-driven, parts of your application that you do not supply code for will receive significantly less testing or no testing at all.
Separate Apps & Non-Security Code: Code belonging to a different application or code that isn't security-relevant (such as unit tests) is excluded.
External Infrastructure & Social/Physical Testing: Broad cloud environment audits, container infrastructure, Denial-of-Service (DoS), social engineering, phishing, and physical security testing are out of scope.
Strictly Prohibited Targets: You may not run an AI Pentest against industrial control systems (ICS/OT/SCADA), life-safety or fire-suppression systems, medical devices or active hospital/patient-care systems, vehicles/aircraft/autonomous navigation systems, or any system you do not own or have explicit legal authorization to test.
Safety Guardrails, Environment Prep & Monitoring
Should I run the AI Pentest on a staging or production environment?
We strongly recommend running AI Pentests against non-production, staging, or test environments wherever feasible. Because the AI Pentest simulates a real attacker and actively demonstrates exploitation when it finds a weakness, it may perform state-changing or potentially destructive operations on the target. This can include:
Creating, modifying, or deleting data, records, files, database tables, or user accounts
Uploading files
Submitting forms
Sending messages/notifications
Triggering automated workflows, billing events, and security alerts
If you choose to test a production environment, you must ensure you have:
Taken adequate backups and/or system snapshots immediately prior to the test
The ability to roll back any changes made during the engagement
Considered and accepted the risk of potential disruption to operations
What safety guardrails are in place during testing?
Intruder maintains strict technical and organizational safeguards to keep testing safe and contained:
Strict Scope Enforcement: The AI pentest agent is restricted to operating strictly within the agreed scope of your target and its supporting resources.
Prompt Injection Mitigations: Because the agent processes content from your target application, we apply industry-standard prompt injection mitigations, including screening prompts through a third-party detection service to prevent external content from manipulating the agent's behavior.
Strict Customer Isolation: Every engagement runs in an isolated testing container. Context, prompts, intermediate states, and outputs are completely separated between customers so no data is ever reused or commingled.
Immediate Halt Control: You have access to an immediate stop control in the Intruder Portal at all times during an engagement, allowing you to halt further testing activity without delay.
Are humans monitoring the AI Pentest in real time?
No. The AI Pentest operates autonomously, and Intruder does not actively supervise or monitor each engagement in real time while it runs. However, you have full visibility via the real-time status page and can halt the test immediately at any time from the Intruder Portal.
(Note: Intruder reserves the right to suspend or halt a test if we detect that continued testing poses a risk to the target, third parties, or our testing infrastructure, in which case we will notify you and re-run the test at no extra cost, assuming no terms were breached.)
Setup, Source Code & Scoping
Do I have to connect source code?
Yes. An AI Pentest is code-assisted, so a connectable repository is required so the agent can review your source code as part of the test. If you cannot connect a repository, you cannot run an AI Pentest.
Which source code providers can I connect?
You can connect GitHub, GitLab, Bitbucket Cloud, and Azure Repos.
Note: Bitbucket Server and Bitbucket Data Center are not supported, and all repositories included in a single pentest must come from the same provider.
Do I have to add test accounts?
Test accounts are optional in the setup wizard, but if any part of your application sits behind a login, you should add them. Without credentials, the agent cannot reach authenticated areas, leaving most of the app untested. For a site with no authenticated area, you can skip this step.
Is there a limit in the scoping instructions field? Can I paste a code review or documentation in there?
Technically, there is no character limit, but we recommend against pasting large files, raw code, or full code review exports into the instructions text box. The scoping area is best used for high-level context, focus areas, and testing guidance.
Can I run an AI Pentest on behalf of my own clients (e.g., as an MSP or consultancy)?
Yes. Under our terms, you may use the AI Pentest for your own internal business purposes or on behalf of your end customers by including their systems as targets, provided you have obtained all necessary legal permissions and authorizations from the system and infrastructure owners. However, you must manage the test yourself. End customers cannot be given direct access to the Intruder Portal.
AI Models, Data Privacy & Security
What AI models do you use?
We currently rely on Anthropic's Claude models, but we aren't locked into a single model forever and continuously evaluate new models to ensure we use whatever provides the best security testing performance.
Can I bring my own model (BYOM) or add Claude Mythos to the pentest?
No, we do not currently support bringing your own model. While Claude Mythos is great for internal code scanning and security reviews, it is not approved for active testing against targets you do not directly own, so we do not use or support it in the AI Pentest.
Is my data used to train AI models?
No. Your data, including your source code, is never used to train, fine-tune, or otherwise improve any AI model, and each customer's data is kept strictly isolated from every other customer's. You retain all Intellectual Property Rights in the source code and data you provide.
What happens to the credentials and code I submit?
Source Code: Processed solely within your engagement's isolated testing container and deleted at teardown. Nobody at Intruder ever accesses a complete copy of your repository. Your source code is sent to Anthropic's Claude API (acting as a sub-processor) as part of the test, where it may be held for up to 30 days before deletion. Intruder may also keep limited source code excerpts for up to 30 days after teardown to deliver your report and improve the service.
Credentials: Encrypted at rest and never included in reports or logs.
Teardown: Everything else from the engagement is deleted at teardown.
For exact retention periods, sub-processors, and data flows, please refer to the AI Pentesting Terms and our Intruder Trust Center - AI FAQs.
Running, Managing & Reporting
How long does an AI Pentest take?
Most tests run in minutes to hours, depending on the size and complexity of your application and how much context you have given the agents. You don't need to wait around while it runs. Real-time progress is shown on the status page, so you can leave and come back at any time.
What happens if there is a third-party service or AI model outage during my test?
The AI Pentest relies on third-party AI model providers and cloud infrastructure. You can monitor ongoing infrastructure status at status.intruder.io (and we will notify you directly if an interruption delays your test by more than 24 hours). If a third-party service issue prevents your pentest from running substantially in accordance with your scope, Intruder will re-run the pentest (or the affected portion) at no additional cost before delivering your final report.
Can I stop or cancel an AI Pentest after starting?
Yes, you can stop a running test at any time up until a report has been generated by clicking Cancel pentest within the Intruder Portal.
How canceling works: Canceling a pentest stops any further activity by the AI pentest agent without delay and confirms in the portal once complete. However, it cannot interrupt actions already in flight at the exact moment you click
Cancel pentest, nor does it undo or roll back changes already made on the target.
No refunds or reports on canceled tests: Canceling stops the test permanently, is not refunded, and will not produce a report for that engagement. Resuming a canceled pentest isn't always possible, so please contact us if you need assistance.
What is included in the report, and who can I share it with?
Upon completion, your AI Pentest Report is available to download in PDF format from the Intruder Portal. It includes:
A detailed description of every identified weakness
An assessment of the impact and likelihood of exploitation
Supporting evidence/proof of exploitation
Suggested remediation advice
You are free to use and distribute the PDF report internally, and you may share it externally with your customers, regulators, auditors, and professional advisors to demonstrate security compliance. (Note: You may not share the report with competing security testing providers without Intruder's prior written consent.)
Does an AI Pentest expire, and can I re-run it?
An AI Pentest is a one-off engagement against a single target. Once launched, you cannot re-run the full test, extend it, or substitute/add targets without purchasing another AI Pentest (though you can retest its findings for free). A purchased pentest must be used within 12 months of your order, after which it expires without refund or credit.
How much does an AI Pentest cost?
Each AI Pentest is a one-off, per-engagement payment paid in advance. Pricing is available on our AI pentest pricing page and at checkout, and it varies by currency and whether you are on a paid plan (existing paying customers currently receive a discount).
Retesting
Do I have to pay for a retest?
No. Retesting is included with your AI Pentest at no extra cost, and there is no limit on how many retests you can run.
How many times can I retest?
As many times as you need. There is no cap on the number of retests. However, you can only run one retest at a time, so you will need to wait for an active retest to finish before starting the next one.
Can I retest only some of the findings?
Yes. You can choose which specific findings go into each retest, either by selecting them individually or selecting all of them. Findings you leave out remain unaffected and can be retested later.
Does a retest test my whole application again?
No. A retest checks only the findings you select from your most recent report. It does not retest the rest of the application and will not pick up new vulnerabilities introduced since the original test. To test the entire application again, you will need to purchase another AI Pentest.
Do I get a new report after a retest?
Yes. Each retest generates its own PDF report showing which findings are now remediated and which are still present. Your original test report remains available to download alongside your retest reports.
Who can start a retest?
Any user with the Admin role on your Intruder account, the same permission level required to set up an AI Pentest.