AI agents and scanners
How an autonomous agent such as PentAGI differs from a DAST or vulnerability scanner, and how to use the two together.
A vulnerability scanner and an AI pentestpentestA penetration test: an authorized attempt to break into systems in order to find their weaknesses. agentagentAn AI agent of PentAGI: a model with its own prompt, settings and tools that does one kind of work in a flow, such as testing, writing code or searching the web. both look for weaknesses, but they work differently. A DAST scanner runs a fixed set of checks against a running application. An agent plans a test from a goal and chooses each next step from what it has found so far.
| What a scanner does | What an AI agent does | |
|---|---|---|
| How it picks the next step | Follows a fixed list of checks and a crawler | Follows its plan and revises it after every subtasksubtaskOne step of a task. PentAGI plans the subtasks of each task and adjusts them as the work goes on. |
| What it can reach | The pages and requests the crawler finds | Whatever the tasktaskOne request in a flow: its first message, or a later message that does not answer an agent's question. PentAGI splits each task into subtasks. names: hosts, services, web applications, APIs |
| What it works with | Its own engine | 20+ security toolstoolWhat an agent acts through: a built-in capability such as the terminal, the isolated browser or web search, or a program in the sandbox such as nmap, metasploit or sqlmap. in a sandboxsandboxThe isolated Docker container in which agents run their tools. The interface shows it as Terminal., web search and code the agents write |
| What it reportsreportThe document PentAGI writes about a flow and its findings. In Enterprise, it is a customer-ready document built from a template. | Matches against known patterns, each to triage | Results with the steps that led to them, collected in a report |
| Whether runs repeat | The same checks give the same results | Two runs of the same task can differ |
| How long it takes and what it costs | Minutes, no model costs | Longer runs that spend model tokens or GPU time |
When to use which
- A scanner gives broad, repeatable coverage: run it in CI on every release or on a schedule to catch known issues early.
- An agent gives depth: it checks whether separate weaknesses add up to a real path into a system, follows up on what a scanner flagged, and tests services a crawler never reaches.
The two work well together. PentAGI can run scanning tools from its sandbox and investigate what they report, and you can upload a scanner's report to a flowflowOne run of PentAGI: a goal, the tasks created from your messages, and everything the agents did along the way. and ask the agents to check its findingsfindingSomething the test discovered and recorded, such as a host, a running service or a vulnerability..
What an agent needs from you
- A target, a goal and a scope, written into the task — see Autonomous penetration testing.
- A strong model for the main agents — see Choosing models.
- Authorization to test every target in scope.
Last updated on