Maced

What is AI pentesting and how does it work?

AI pentesting uses autonomous agents to simulate real-world attacks against your applications, APIs, and infrastructure. The agents map your attack surface, probe for vulnerabilities, attempt exploitation, and validate findings — all without manual intervention.

How long does a pentest take?

Most pentests complete within hours rather than the weeks typically required for traditional manual engagements. You can monitor agent activity in real time and receive your full report the same day.

Can I use the report for SOC 2 or ISO 27001 compliance?

Yes. Every pentest produces an audit-grade PDF report structured to satisfy SOC 2 and ISO 27001 requirements, including executive summary, detailed findings, evidence of exploitation, and remediation guidance.

What's the difference between white-box and black-box testing?

In white-box testing, agents have access to your source code and can identify vulnerabilities through code analysis alongside active probing. Black-box testing simulates an external attacker with no internal knowledge. Maced supports both modes — white-box testing is enabled automatically when you connect your repositories.

Do I need to share my source code?

No — source code access is optional. Black-box pentests run without it. However, connecting your repos enables white-box analysis, which significantly increases coverage by allowing agents to understand application logic, authentication flows, and data models.

How do you prevent false positives?

Every finding is validated through actual exploitation against your live target. If an agent cannot successfully exploit and confirm a vulnerability, it is discarded. Only verified, reproducible findings appear in your report.

Is it safe to run against production?

Agents are designed to detect and validate vulnerabilities without causing disruption. You define the scope — which domains can be tested and which are off-limits — and all agent traffic is enforced through strict guardrails. A kill switch is available to stop all agents instantly.

What types of vulnerabilities can it detect?

Maced covers the OWASP Top 10, injection flaws, broken access controls, authentication weaknesses, IDOR, SSRF, business logic errors, API misconfigurations, and more. Agents reason about application behavior to find issues that scanners miss.