What is agentless penetration testing?

Agentless penetration testing assesses targets over the network without requiring a persistent testing agent on every host. The test still runs somewhere: in a container, on an appliance or on another system with access to the targets.

Network position determines what the test can reach

A testing system on one subnet may see services that are inaccessible from another. Firewalls, routing and authentication affect coverage. Removing the need for a per-host rollout does not remove those constraints.

For an objective behind several access boundaries, the test must establish each part of the route with the techniques and credentials available to it.

Choose the segment that matches the concern

Suppose the question is whether access to a guest network could lead to a finance file share. Deploying the test in an administrative network would bypass the boundary you meant to assess. A test starting on the guest network must contend with its actual routing and firewall rules.

If the share is unreachable from that position, record that result with the location and scope of the test. Moving the container to another segment changes the starting conditions. It may help investigate a different route, but its result cannot stand in for the original guest-network test.

What AutoAttack requires

AutoAttack runs one Docker container per campaign on its deployment host. That host needs access to the network being tested and outbound access to the AutoAttack service. The customer systems under test do not need a persistent AutoAttack agent installed on each one.

You can provide starting credentials or let the campaign begin without them. The deployment guide covers setup; the assumed-breach guide explains when a supplied identity is useful.

Use the internal network testing guide to choose the segment and target access your deployment will assess.

Review campaign controls

Set the objective, authorized scope, exclusions and starting access before deployment. Review the reversible changes included in the campaign setup. The security page describes the runtime controls and stop action.