What is PENOPS
PENOPS runs AI agents that test what you own, routes what they prove to your delivery boards, and keeps a human in control of every risky step.
Overview
PENOPS is a security operations and AI pentest platform. You describe what you own and how hard it may be tested, PENOPS agents test it on a schedule or on demand, and every confirmed finding becomes a card your team triages, fixes and verifies.
It covers four kinds of target: web applications, cloud accounts (AWS, Azure, GCP), LLM model endpoints and secrets sources (Git repositories, storage buckets and container images).
The main areas
| Area | Where | What you do there |
|---|---|---|
| Engagements | Manage > Engagements | Define what is in scope, which checks run, when they may run and how hard PENOPS may hit the target. See Create an engagement. |
| Targets | Pentests > Targets | Watch the AI agents work each target, read every step they took, and approve or reject risky tests. See Targets and missions. |
| Exposure | Pentests > Exposure | See every in-scope target with its observed surface and open findings. See Exposure. |
| Delivery boards | Operations | Triage findings on Risk Treatment, fix them on Remediation Delivery, and track accepted risk in the Risk Register. See Delivery boards. |
| Surface Intelligence | Intelligence > Surface Intelligence | Review hosts your web app engagements discovered that are not yet under test. See Surface Intelligence. |
| Administration | Manage | Invite your team and set permissions, connect integrations, and organize engagements into organizations. See Team and permissions. |
How the pieces connect
- An engagement defines the test. You pick a type, add targets, choose coverage and set a schedule. Cloud, LLM and secrets engagements scan through an integration you connect first.
- Agents run against the targets. Each run sends AI agents at every target in the engagement. For each idea they want to prove, the agent opens a mission you can follow on the Targets page.
- Risky actions wait for you. When a planned test could change data or disrupt a service, the agent pauses and asks for approval. See Human-in-the-loop approvals.
- Confirmed attacks become findings. Each finding lands as a card in Intake on the Risk Treatment board, where you decide how to treat the risk.
- Fixes are verified. Engineers pick up cards on Remediation Delivery, and PENOPS re-tests the fix before the card closes. See Fix validation.
- Discovery feeds scope. Web app engagements discover hosts outside their scope. These appear in Surface Intelligence so you can decide whether to monitor them, scan them once, or add them to an engagement.
You stay in control
Detection and minimal proof run on their own. Anything that would trip a guardrail, such as a destructive change or a service disruption, stops and asks a person with the right permission. You can approve once, approve similar tests for the rest of that scan, or reject.
Every step the agent takes, including the exact test script and its raw output, is recorded on the mission so you can check its reasoning.
Next steps
- Learn the vocabulary in Core concepts.
- Follow Your first engagement from sign-in to first findings.