What is automated penetration testing?

Automated penetration testing uses software to carry out assessment steps that a tester would otherwise perform by hand. These can include discovering services, attempting known techniques and collecting evidence. The useful result is the access the test establishes toward an agreed objective.

Automation and autonomy describe different parts of the work

A fixed workflow might run the same checks against every reachable host. An adaptive system can use an earlier result to choose a later step: try a recovered credential on a second service, for example.

Autonomous penetration testing adds that decision process to the execution. A product can be both automated and autonomous. Calling every automated tool a fixed script hides differences that matter when choosing one.

Compare the conditions, then the results

Two tests can produce very different reports because they had different starting access. Record the network position, credentials, exclusions and permitted actions before comparing results.

For an internal assessment, the automated network penetration testing page explains AutoAttack's deployment fit, report access and pricing.

Then look at what each test actually established. A vulnerability check can identify a condition worth investigating. A successful attack step can demonstrate access. Both can be useful, but their counts measure different things.

What a repeat run tells you

Repeating a test after a configuration change provides new evidence from the changed environment. Set the objective and scope to reach and test the relevant system or permission.

AutoAttack starts a fresh campaign each time and reports what that campaign reached. See how to read the report and the lab comparison methods.

Compare two tools on the same question

Suppose you want to know whether an ordinary employee account can read a designated finance document. Give both tests the same starting identity, network position and permitted scope. Keep the target document and the evidence required for a successful read the same.

One tool might identify a readable share while another retrieves the document. Those results establish different access. Check what each actually attempted before attributing the difference to its level of automation. If one test used an administrator account, it answered a different question from the start.