AI penetration testing · by VamiSec

Multi-agent penetration testing. Scoped. Supervised. Verified.

Three agents: reconnaissance, application crawling, exploitation. Authorised scope only. Every finding verified with proof.

Book a 30-minute demo See how it works
70%less time per pentest engagement
58%faster vulnerability chaining after initial foothold
Daysper engagement, not weeks

IT security and compliance without AI is a vulnerability.

Valeri MilkeFounder & CEO, VamiSec
Targets

Any target in your authorised scope.

Web applications
APIs
Active Directory
Enterprise networks
Single hosts & IPs
Cloud
AI systems
The team

Three specialised agents.

Parallel execution. Isolated environment per organisation. One shared attack-surface graph.

Recon · attack-surface mapping

  • Hosts, services, technologies, subdomains
  • Forgotten and shadow assets
  • Continuous discovery during testing

Smart crawler · business-logic understanding

  • Authenticated crawling of real workflows
  • Roles, data, transactions: what is worth attacking
  • Endpoints and flows scanners miss

Pentester · verified exploitation

  • Injection, access control, misconfiguration, logic abuse
  • Attack-path chaining
  • Reproduction and proof mandatory, CVSS 3.1 per finding
The approach

Business-logic understanding drives the threat model.

Understand

Authenticated crawling: roles, workflows, transactions.

Model

Value paths, role boundaries, skippable steps.

Attack

Effort by impact. Proof per finding.

Walkthrough

From scope to report.

Define the scope.

  • Domains, IP ranges, hosts, applications
  • Each target typed: web app, API, AD, host, cloud, AI
  • Extend or reduce scope mid-run
SCOPETYPEshop.example.comWeb applicationapi.example.comAPI10.0.0.0/24IP range203.0.113.10Hostcorp.example.localActive Directoryassistant.example.comAI system

One attack-surface graph.

  • Physical: hosts, services, technologies
  • Logical: endpoints, roles, workflows
  • Each node: findings, evidence, discovery path
  • Shared by agents and analysts, live
Attack-surface graph

No reproduction, no finding.

  • Evidence, reproduction, proof
  • Impact and remediation
  • CVSS 3.1, computed from the vector

SQL injection in order lookup

Critical 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Target
https://shop.example.com/api/orders?id=
Reproduction
Request id=1042 AND 1=1, then id=1042 AND 1=2. The first returns the order, the second nothing.
Proof
Database version and first row of users retrieved, logged with request and response.
Impact
Read access to all customer orders and accounts from any customer login.
Remediation
Parameterised queries, integer validation of id, least-privilege database account.

PDF report per engagement.

  • Executive summary
  • Scope, methodology, attack-surface overview
  • Findings by severity with evidence, proof, remediation, CVSS
  • XLSX, CSV, one-click VamiGRC sync
PDF report pages
Demo

Quick PoC demo of an engagement.

Autonomy modes

Supervised or autonomous. Per agent. Switchable live.

Supervised: approval per command

Approve, edit or reject each action. First engagements, production systems.

Autonomous: run and review

Plan and execute inside the scope. Live view, result review. Routine testing.

Human in the loop pays off: an experienced pentester steering the agents, pointing them at the right targets and cutting dead ends, reduces engagement time drastically.

LLM agnostic

Your provider. Model per agent. Your keys.

Anthropic
OpenAI
Google Gemini
Mistral
Llama
Self-hosted
Who it is for

Security teams. CISOs. MSSPs.

Small security teams

Few people, large attack surface or many engagements.

Internal security teams

Testing per release, not per year.

CISOs in regulated industries

Test evidence on demand: DORA, NIS2, audits.

Consultancies and MSSPs

More engagements, same experts.

Hosting & trust

Hosted in Germany. T Cloud Public.

VamiSec GmbH, Bonn. ISO 27001-led. Deutsche Telekom infrastructure.

T Cloud PublicData stays in Germany.

Trust Center →

FAQ

FAQ

Does it replace penetration testers?

No. Groundwork and documentation are automated. Scope, review and judgement stay with your experts or ours.

What can be tested?

Web applications, APIs, Active Directory, enterprise networks, single hosts and IPs, cloud and AI systems, inside your authorised scope.

Is it safe to run against production?

Scope enforcement per action, approval per command in supervised mode, instant stop. Typical start: supervised on staging.

How long does an engagement take?

First confirmed findings in hours. Full engagement in days, depending on scope.

Which AI model does it use?

Whichever you choose: Anthropic, OpenAI, Google, Mistral, open-weight or self-hosted, per agent, with your keys.

Next step

Live demo on a real target. 30 minutes.

Then a scoped pilot on your systems.

Book a 30-minute demo Talk to us first
Valeri Milke
Valeri MilkeCEO, VamiSec GmbHISO 27001 & ISO 42001 Lead Auditor · NIS2 & DORA

LinkedIn →

Jobs at VamiSec

We're hiring for VamiRedteam.

Your expertise meets our AI platform: you work on real client engagements and feed your experience straight into the evolution of VamiRedteam.

IT Security Engineer (m/f/d) – Penetration Testing & Red Teaming

You think like an attacker and work like an engineer – in classic pentests, red team engagements and AI system testing, supported by VamiRedteam.

  • Full-time
  • Professional–Senior
  • Remote-first · Bonn
  • German C1+
Apply nowJob details

IT Security Engineer & Evangelist (m/f/d) – Penetration Testing & AI Red Teaming

You test applications, networks and AI systems like an attacker – and you make the topic visible: in webinars, talks, articles and conversations with prospects. The focus stays on the technical work.

  • Full-time
  • Professional–Senior
  • Remote-first · Bonn
  • German C1+
Apply nowJob details

All open positions →