What people ask before letting software test them.
Every answer below opens with a sentence that stands on its own, because the question usually arrives out of context.
What is autonomous penetration testing?
Autonomous penetration testing is a security test in which software performs the engagement itself rather than assisting a human tester. In Seccuti the agent does the reconnaissance, obtains authenticated access, hunts for vulnerabilities, tries to prove them and writes the report, while a human defines the scope and authorization first.
How does Seccuti stay inside scope?
Every action is re-checked at the moment it runs by a gate the agent cannot reach or change. The gate confirms the exact target is in scope, the testing window is open, and the class of action was pre-authorized. Anything else is refused and recorded.
Can I stop a test that is already running?
Yes. A kill switch stops every action immediately, and the emergency contact named on the engagement can trigger it without waiting for anyone at Seccuti.
Does Seccuti report findings it has not proven?
A detection is not shipped as a finding. Each candidate is re-tested against the live target, and one that cannot be reproduced is marked refuted rather than counted.
What do I need before a test can start?
An engagement needs targets in scope, a signed authorization, a testing window and an emergency contact. Seccuti refuses to run an engagement that is missing any of them.
In which languages can Seccuti write the report?
Reports are produced in Turkish or English. The deliverable language is set per organization, so the report arrives in the language of the people who will read it.
Will testing take my systems down?
Destructive action classes are off by default and can only be enabled by a named person, and blast radius ceilings bound how many hosts and how many requests a run may produce. A breached ceiling halts the run rather than continuing more slowly.
Do I need to install anything?
No. Testing is performed the way an external attacker would reach your systems, so there is nothing to deploy inside your estate.
Can the agent be tricked by content on my site?
Everything a target returns is treated as untrusted data. It cannot widen scope, change the action policy, authorize an action or cause a secret to be revealed.
Who can see my findings?
Only members of your organization, and any client you deliberately grant portal access to. Separation between tenants is enforced in the database rather than in application code, so a query that forgets a filter returns nothing rather than someone else's data.
How is this different from a vulnerability scanner?
A scanner produces detections for someone to triage; Seccuti carries out the engagement, gets authenticated, tries to prove what it finds, and drops what it cannot reproduce.
Does it replace a human penetration tester?
No. Business logic that only makes sense if you know the company is still a human job. Seccuti covers the mechanical part continuously so human hours go where they are worth the most.
The rest is easier to judge by running it.
One target, one envelope.