# AI agents and scanners

> How an autonomous agent such as PentAGI differs from a DAST or vulnerability scanner, and how to use the two together.

A vulnerability scanner and an AI [pentest](https://pentagi.com/docs/glossary/#pentest) [agent](https://pentagi.com/docs/glossary/#agent) both look for weaknesses, but they work differently. A DAST scanner runs a fixed set of checks against a running application. An agent plans a test from a goal and chooses each next step from what it has found so far.

|                                           | What a scanner does                            | What an AI agent does                                                                                                    |
| ----------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| How it picks the next step                | Follows a fixed list of checks and a crawler   | Follows its plan and revises it after every [subtask](https://pentagi.com/docs/glossary/#subtask)                                           |
| What it can reach                         | The pages and requests the crawler finds       | Whatever the [task](https://pentagi.com/docs/glossary/#task) names: hosts, services, web applications, APIs                                 |
| What it works with                        | Its own engine                                 | 20+ security [tools](https://pentagi.com/docs/glossary/#tool) in a [sandbox](https://pentagi.com/docs/glossary/#sandbox), web search and code the agents write |
| What it [reports](https://pentagi.com/docs/glossary/#report) | Matches against known patterns, each to triage | Results with the steps that led to them, collected in a report                                                           |
| Whether runs repeat                       | The same checks give the same results          | Two runs of the same task can differ                                                                                     |
| How long it takes and what it costs       | Minutes, no model costs                        | Longer runs that spend model tokens or GPU time                                                                          |

## [When to use which](https://pentagi.com/docs/concepts/agents-and-scanners/#when-to-use-which)

* A scanner gives broad, repeatable coverage: run it in CI on every release or on a schedule to catch known issues early.
* An agent gives depth: it checks whether separate weaknesses add up to a real path into a system, follows up on what a scanner flagged, and tests services a crawler never reaches.

The two work well together. PentAGI can run scanning tools from its sandbox and investigate what they report, and you can upload a scanner's report to a [flow](https://pentagi.com/docs/glossary/#flow) and ask the agents to check its [findings](https://pentagi.com/docs/glossary/#finding).

## [What an agent needs from you](https://pentagi.com/docs/concepts/agents-and-scanners/#what-an-agent-needs-from-you)

* A target, a goal and a scope, written into the task — see [Autonomous penetration testing](https://pentagi.com/docs/concepts/autonomous-pentesting/#where-you-stay-in-control).
* A strong model for the main agents — see [Choosing models](https://pentagi.com/docs/configuration/llm-providers/#choosing-models).
* Authorization to test every target in scope.