Question 1

What is AutoAttack?

Accepted Answer

AutoAttack is autonomous penetration-testing software: an AI adversary you deploy inside your own network that red-teams toward a goal you set in plain English (reach Domain Admin, read a sensitive inbox, prove ransomware reach), and proves every step with captured evidence. It is not an exposure-inventory tool: every step it reports is a confirmed compromise, reached and proven.

Question 2

What is a hop?

Accepted Answer

A hop is one access or credential transition where the adversary gained something it did not have a moment earlier: a credential, administrator rights on a host, control of a domain, access to a named asset or to a class of data. Probes, reconnaissance and attempts that failed are not hops. That is why the report is shorter than an inventory of everything the run saw, and why every line on it is something that happened, with the captured evidence behind it.

Question 3

Is it safe to run AutoAttack inside my network?

Accepted Answer

Yes. The adversary throttles credential attempts to your domain's real lockout policy, installs nothing, changes no settings, runs no payload that trips antivirus, and writes nothing to your hosts' disks. Each campaign runs in an ephemeral container that is destroyed when the engagement ends.

Question 4

How is pricing calculated?

Accepted Answer

Pricing is graduated per discovered host, billed annually: $49 per host for 1–100 hosts, $34 for 101–500, $19 for 501–2,500, and $9 for 2,501–10,000. There is no minimum and no feature gating. Every plan gets every feature. Above 10,000 hosts, contact sales.

Question 5

What do I see before I subscribe?

Accepted Answer

You can register, deploy, and run a full campaign for free, and the whole run is visible: every hop, with the technique and the weakness behind it. What a subscription reveals is the target names, the captured proof, the fix for each weakness, and — on a run that fell short of its objective — the written account of where it ran out. Until then a target appears as a placeholder that is stable for the campaign, so a run across 400 hosts still reads as 400 distinct hosts, and what a step gained reads as the kind of access it was rather than the machine it landed on. There is one report either way, the run's own page: it fills in as the run happens and stands as the finished report once it stops. Every account opens that page. There is nothing to download and no second document a subscription unlocks.

Question 6

Why does the report have fewer lines than my other tools?

Accepted Answer

Two reasons, and neither is that something was left out. It holds only the steps that led to something the adversary achieved, so a weakness it never used to get anywhere is not on the page. And a weakness present on many hosts is one line carrying an exact count, rather than one line per host: the first 5 targets are named beside it and the line says how many more it did not name. Open ports, versions and reachable services are assets, not hops. The count is the measurement and it is never rounded, capped or estimated; the only bound is on that printed list of names, and it states itself.

Question 7

Does the report have severity scores or a findings list?

Accepted Answer

No — the report is one account of the run from first foothold to the objective with the evidence behind every step; there is no severity level, no CVSS score and no second list to reconcile; and a proven path orders remediation by attack sequence: the choke point the path crosses is what to fix first, because breaking it severs every route through it; what remains is governed by your own risk process. When no route reaches the objective, the report is the account of the routes it tried — a result, not a failed run.

Question 8

Does AutoAttack replace my penetration test?

Accepted Answer

It complements one. A human penetration test is a point-in-time snapshot booked weeks out; AutoAttack runs whenever you deploy it, as often as you need. Like a good pentester it proves every step with captured evidence, but it does not get bored, distracted, or run out of hours.

Question 9

How do I deploy it?

Accepted Answer

Register, create a campaign, and run the provided Docker command with your campaign token. The agent phones home, the campaign starts, and each hop appears in the live view as it lands. There is no software to install on your hosts.

Question 10

How fast does AutoAttack reach Domain Admin?

Accepted Answer

That depends on the network it is pointed at, and the run is what answers it: the adversary drives the full attack toward Domain Admin and, when it lands, proves the route to it step by step with captured evidence. The runs measured against a public Active Directory range, with the lab and the conditions stated beside each figure, are published on the benchmark page.

Question 11

How were the published benchmark results measured?

Accepted Answer

Every published figure is a run AutoAttack executed against a public, open-source Active Directory range, with no credentials provided to any tool and each run starting from a fresh virtual-machine rollback. The attack chain and the run-by-run method are published with the results, so they can be reproduced.

Question 12

Where is my data stored?

Accepted Answer

Campaign records, their captured evidence, and account information are hosted within the European Economic Area (France), encrypted in transit with TLS, and isolated per account.

AI penetration testing FAQ.