Autonomous security testing

Penetration testing,
fully autonomous.

AI agents that systematically test your web applications against OWASP standards. Launch a full-scope assessment with a single click.

Coming Soon See How it Works
app.runscarab.io/assessments/a7f3e2b1
Dashboard
Applications
Assessments
Findings
Settings
crAPI — Assessment #47
Started 12 min ago · Injection phase · 68% complete
● Live
Critical
3
High
7
Medium
12
Endpoints
84
Recent Findings 22 total
Critical SQL Injection in /api/mechanic injection New
Critical BOLA via user ID parameter authz New
High JWT secret brute-forceable auth Confirmed
High No rate limiting on OTP endpoint auth Confirmed
Medium CORS misconfiguration allows wildcards config New

What is SCARAB?

SCARAB is an autonomous penetration testing platform that uses AI agents to systematically assess the security of your web applications and APIs. Instead of point-and-click scanners that check for known signatures, SCARAB deploys a team of specialized agents — each an expert in a different domain of security testing — that reason, adapt, and collaborate like a human penetration testing team.

Every assessment is grounded in industry-standard methodology with comprehensive coverage across reconnaissance, authentication, injection, authorization, configuration, business logic, and client-side testing. Results stream to your dashboard in real time, complete with evidence and remediation guidance.

How it Works

01

Register Your Application

Add your target URL, configure scope boundaries, and provide any credentials needed for authenticated testing. SCARAB supports multi-role testing with separate user and admin accounts.

02

Launch an Assessment

One click spins up an isolated container with the full testing toolkit. AI agents execute in sequence — recon, auth, config, injection, authorization, business logic — each building on prior findings.

03

Review Findings in Real Time

Watch findings stream in live as agents work. Each finding includes severity, affected endpoints, full HTTP evidence, and remediation guidance. Export a self-contained HTML report when complete.

Built for Real Security Testing

[ ◉ ]

AI Agent Architecture

Six specialist agents coordinate through shared state. No fixed playbooks — agents reason about what to test and adapt to what they find, just like a human pentester would.

[ ⚡ ]

Real-Time Monitoring

Server-sent events stream every finding, endpoint, and checklist update to your browser as it happens. Full visibility into what each agent is doing and why.

[ ✓ ]

Standards-Based Coverage

Tests mapped to established security methodologies including the OWASP Web Security Testing Guide. Systematic baseline coverage with the flexibility to go deeper where it matters.

[ ⊞ ]

Full Evidence Chain

Every finding includes the complete HTTP request and response that triggered it. No false positives without proof — every vulnerability is demonstrated with reproducible evidence.

[ ◈ ]

Flexible AI Models

Run assessments with your choice of AI provider. Mix and match models per agent — use a powerful model for complex testing, a fast one for reconnaissance.

[ ⬡ ]

Isolated Execution

Each assessment runs in its own isolated container with a full security testing toolkit. Completely sandboxed, fully reproducible, zero infrastructure to manage.

What Gets Tested

Six specialist agents, each responsible for a different domain of security testing.

Recon

Information Gathering

Server fingerprinting, endpoint discovery, technology mapping, API documentation analysis, and application route extraction.

Auth

Authentication & Sessions

Credential testing, session management, MFA bypass, password reset flaws, cookie security, session fixation, and cross-site request forgery.

Config

Configuration & Cryptography

Platform configuration, HTTP methods, security headers, error handling, stack trace leakage, TLS/SSL scanning, and encryption verification.

Injection

Input Validation

Cross-site scripting, SQL injection, command injection, template injection, server-side request forgery, path traversal, and more.

Authz

Authorization

Insecure direct object references, privilege escalation, authorization bypass, and cross-role comparison testing with multi-credential support.

Logic

Business Logic

Workflow bypass, race conditions, constraint violations, and application-specific logic flaws that traditional scanners miss entirely.

Coming soon.

SCARAB is in private beta. Sign up to get notified when we open access.

Get in Touch →