You set the envelope
Paste the targets, sign the authorization, set the testing window, name an emergency contact, and choose which classes of action are allowed. Seccuti refuses to run without all five.
Seccuti: autonomous penetration testing inside a signed scope
Autonomous red team
It tests like an attacker.
Give it a web application, an API or a public IP range. It maps the surface, gets itself authenticated, hunts, proves what it finds, and writes the report - inside a scope you sign first.
- Runs unattended
- Stops where you said
- Proven, not detected
- Turkish or English report
Recon
Hosts, open ports and services, endpoints, parameters, technologies, and the files nobody meant to leave reachable.
Authenticated
Your credentials, or an account it registers itself where sign-up is open, so access control can be tested.
The hunt
Injection, broken access control, authentication flaws, exposed data, misconfiguration, known vulnerable components.
Proof
Each candidate re-tested against the live target, with the request and response that demonstrate it.
Report
Severity, evidence, business impact and remediation, as a finished document.
Retest
Confirm a fix the day it ships, without booking a new engagement.
How does an autonomous penetration test actually run?
An engagement runs as six steps, and a human is only present for the first one. You define the envelope once; the agent works inside it until the surface is exhausted, then writes what it found and how it proved it.
It maps the surface
Hosts, services, endpoints, parameters, technologies and the files nobody meant to leave reachable. Everything it learns is recorded against the asset it came from.
It gets authenticated
Most real issues live behind the login. The agent uses the credentials you supplied, and where a site allows sign-up it registers its own marked test account so it can test access control between two identities.
It hunts
Injection, broken access control, authentication flaws, exposed data, misconfiguration and known vulnerable components, worked through as a methodology rather than a checklist.
It proves or drops it
Each candidate is re-tested against the live target. What reproduces gets evidence attached. What does not is marked refuted, so your list is not padded with maybes.
It writes the report
A finished deliverable in Turkish or English, with severity, evidence, business impact and remediation. When you fix something, ask for a retest instead of a new engagement.
What stops an autonomous tester from going too far?
A gate that sits between the agent and the operating system, and that the agent cannot reach, modify or talk its way past. It re-checks every action at the moment of execution. You do not have to trust the agent's judgement, because the agent is not the one deciding.
Checked on every action
The exact target is in scope. Not the project, the target. A host that resolves to an address outside the declared range is refused even if the name was allowed.
The testing window is open. Outside the hours you agreed, nothing runs.
The action class was pre-authorized. Exploitation and anything destructive are off unless a named person turned them on, and that is recorded.
The breakers have room. Host count, request rate, spend and run time all have ceilings. A breach halts the run and notifies your emergency contact.
What the gate refused, as your customer sees it
REFUSED
partner-crm.io
not in scope
REFUSED
10.9.0.0/16
resolves outside declared range
REFUSED
credential testing on login
action class disabled
REFUSED
app.acme.com
outside the testing window
EXECUTED
app.acme.com
in scope, window open, class allowed
Every refusal is shown to the customer with the reason. Hiding them would remove the evidence that the boundary held.
What do you get at the end?
A deliverable a customer can act on, and the working material behind it. Not a list of detections for someone else to triage.
Findings that were proven
Each finding carries the request and response that demonstrate it, where it was found, the impact in the customer's terms, and the fix. One issue is one finding, however many places it appears.
A report in your customer's language
Turkish or English, written at generation time and checked again before it ships. The language follows the organization that receives it, not whoever pressed the button.
The record of what was done
Every action, its target, and the gate's decision, in order. This is what turns an autonomous test into something you can put in front of an auditor.
Questions people ask before letting software test them
What is autonomous penetration testing?
Autonomous penetration testing is a security test in which software performs the engagement itself rather than assisting a human tester. In Seccuti the agent does the reconnaissance, obtains authenticated access, hunts for vulnerabilities, tries to prove them and writes the report, while a human defines the scope and authorization first.
How does Seccuti stay inside scope?
Every action is re-checked at the moment it runs by a gate the agent cannot reach or change. The gate confirms the exact target is in scope, the testing window is open, and the class of action was pre-authorized. Anything else is refused and recorded.
Can I stop a test that is already running?
Yes. A kill switch stops every action immediately, and the emergency contact named on the engagement can trigger it without waiting for anyone at Seccuti.
Does Seccuti report findings it has not proven?
A detection is not shipped as a finding. Each candidate is re-tested against the live target, and one that cannot be reproduced is marked refuted rather than counted. That is the difference between a scan result and a penetration test.
What do I need before a test can start?
An engagement needs targets in scope, a signed authorization, a testing window and an emergency contact. Seccuti refuses to run an engagement that is missing any of them.
In which languages can Seccuti write the report?
Reports are produced in Turkish or English. The deliverable language is set per organization, so the report arrives in the language of the people who will read it.
Point it at something you own.
Set the envelope in a few minutes. The agent takes it from there.