What is autonomous penetration testing?

Autonomous penetration testing uses software to pursue a security objective without a person directing each step. You define the target and the permitted scope. The system discovers what it can reach, attempts to gain access and uses the results to decide where to go next.

An objective gives the test a concrete question: can someone starting from this network segment obtain Domain Admin, or read a particular file share?

How a campaign develops

The route depends on what the test finds. A password exposed in a shared file might open another host. Access to that host might reveal an account with wider permissions. A failed login or an unreachable service can send the test elsewhere.

This is the distinction between executing a test step and choosing the next one. Automation handles execution; autonomy adds decisions based on results. AI is one way to support those decisions.

What the result establishes

A successful campaign shows a route that worked under the test conditions. Its evidence should connect the starting access to the objective, including the credentials or permissions gained along the way.

For an objective that remains open, read the campaign status and the access it gained. Keep the starting position and authorized scope with that result.

Evaluate it with an objective you can check

Choose a concrete question, such as whether the test can read a designated document on a named share. Record the deployment position, starting credentials, exclusions and permitted changes. Keep those conditions with the report: changing the identity or network segment can change what the same software can reach.

Before deploying, check the host requirements, supported systems, permission controls and stopping procedure. Find out where objectives, credentials and captured evidence are processed. AutoAttack describes these in its quickstart and campaign controls.

Judge the result against the original question. Follow the access gained from the starting point, inspect the evidence supporting a claim, and distinguish unsuccessful attempts from gains. Our report-reading guide explains what to look for.

A free AutoAttack campaign lets you inspect the steps, technique and weakness labels, and anonymous target relationships. A subscription reveals target identities, captured evidence and remediation advice. You can review how the report is organized before buying the full details.

Plan the wider engagement

Use the campaign’s technical results in a red team engagement that examines how people detect and respond to an intrusion. An agreed human engagement can add social engineering, physical access or a signed assessor’s attestation.

AutoAttack is an autonomous red team agent that pursues your objective at machine speed. It chains real attacks and uses newly gained credentials and footholds to continue toward the goal. The quickstart explains deployment and the report; the published lab runs show the attacks and results.