Agentic pentest with Berghem Agents: how it works

An agentic pentest is a penetration test run by AI agents that pursue a defined objective — not just execute pre-programmed steps. The agent holds context, forms hypotheses, chains flaws, and looks for evidence all the way to the critical asset, always inside an approved scope and under the direction of a human specialist.

The word "autonomous" causes confusion because it describes both a scanner that runs on its own and an agent that decides what to do next. These are different things. A scanner runs a fixed battery of checks and returns a list. An agent receives a mission — the asset that cannot be compromised — and investigates the routes that lead to it, adjusting its path as it observes the target. This article explains what changes in practice, the phases an agent goes through, how Berghem operates the model, and where it still depends on human judgment.

What is an agentic pentest?

An agentic pentest applies AI agents — not a single prompt, but a system that observes, decides, and acts in a loop — to a penetration test. The core difference from traditional automation is agency: the agent holds an objective, selects tools, interprets the result of each action, and reformulates the next hypothesis, instead of running a pre-programmed sequence of checks.

In practice, this means the agent preserves state. It keeps the same identity and session as it crosses a web application, an API call, and the return to the web layer; it compares responses across user profiles; it remembers what it has already tested; and it correlates signals that, in isolation, would mean nothing. That working memory across the investigation is what brings the behavior closer to a professional's, and what separates an agent from a generic "web agent" that merely clicks through a page.

It is worth separating two concepts that are often confused. Running a pentest with AI agents — the subject of this article — means using agents as an offensive tool against conventional systems. Running a pentest of AI systems is the opposite: testing the security of an organization's own agents, models, and pipelines, which we cover under security for AI agents. Both rely on the same techniques but solve different problems.

Agentic pentest, scanner, or manual pentest: what is the difference?

The difference lies in who decides the next step. A scanner follows a fixed script and does not chain findings; a manual pentest chains them but is bounded by one person's time; an agentic pentest chains with the reach of a machine, keeping the specialist as the one who defines the mission and validates the result. The table below summarizes the axes that matter most in the decision.

None of the three approaches replaces the others in every scenario. A scanner remains useful for continuous hygiene and low-cost coverage. The manual pentest stays irreplaceable for ambiguous business logic and for the final judgment. The agentic pentest occupies the space between the two: it gives the specialist the reach to investigate far more routes than they would explore by hand, without giving up the chaining a scanner never produces.

What phases does an agent go through in an investigation?

An agent does not improvise from scratch: it operates within a loop that runs from defining the mission to delivering evidence. The phases repeat and feed back into one another — a confirmed hypothesis generates new hypotheses, a blocked route leads to another. We describe the cycle as seven stages:

1. Mission and limits. The specialist defines the objective, the crown jewel (the critical asset), the surfaces in scope, the permitted actions, and the stop criterion. Nothing starts without that framing.
2. Reconnaissance. The agent enumerates the surface: endpoints, authentication flows, exposed business rules, integrations, and what the session actually reaches.
3. Hypothesis. From what it observed, the agent forms and prioritizes attack hypotheses — which flaw, if any, gets closer to the objective.
4. Action. The agent executes the test: manipulates a parameter, attempts an authorization bypass, chains a condition. Sensitive actions go through approval.
5. Verification. The result is confirmed. A false positive is discarded; a real finding is re-run to guarantee reproducibility.
6. Correlation. The agent crosses surfaces — web, API, back to web — keeping the same identity and state to show not just that the flaw exists but that it reaches the core business.
7. Decision. The agent changes route, digs deeper, or stops according to the defined criterion, recording evidence, logs, and replay for every step.

It is stage 6 that separates an agentic pentest from a checklist of isolated vulnerabilities. Proving that an API endpoint exposes a broken authorization is a finding; demonstrating that this flaw, chained to a legitimate web session, leads to the manipulation of a financial flow is an attack path with business impact — and that is what drives the order of remediation.

What types of testing does an agent cover?

A single agent covers multiple surfaces because it keeps context as it crosses from one to another, instead of treating each as a separate test. The fronts that benefit most from this model:

• Web applications and APIs — the pair where correlating identity and state across surfaces pays off the most, from login to business rule.
• Cloud pentest — enumeration of permissions, configurations, and escalation paths in elastic environments.
• Network pentest — movement between internal hosts and services from a foothold.
• Mobile pentest — in limited scopes, assessing the app and its backend integrations.
• Red Team exercises — the agent extends reconnaissance and chaining reach, while the human team drives strategy and objective.

In every case, the value is not in replacing the surface-specific tool but in keeping a single mission alive across them — something a set of independent scanners does not do.

How does Berghem run an agentic pentest?

Berghem operates this model through Berghem Agents, an agentic EHT product with a multi-model architecture. Instead of depending on a single model, the system chooses the intelligence route according to the task, the sensitivity of the data, and the client's constraints — using specialized, private, authorized third-party models, or models inside the client's own tenant when data cannot leave the environment.

The operation is organized into four layers. The mission and limits layer fixes the objective, core business, surfaces, permitted actions, and stop criterion. The intelligence layer decides which model processes what. The execution layer drives the browser, APIs, and specialized tools. The control and evidence layer handles identities, approvals, logs, the circuit breaker, replay, and reporting. Autonomy is proportional to risk: scope and access are defined before execution, sensitive actions require approval, and irreversible operations can be blocked.

The one thing Berghem does not give up is human direction. The specialist stays at the center: defining the mission and the crown jewel, interpreting ambiguity, authorizing sensitive actions, and being technically accountable for the result. The agent extends reach; the specialist preserves judgment. Two decades of pentesting for Latin American financial institutions underpin the methodology — the experience that informs which routes are worth investigating and which findings matter to the business.

Where does the human fit in the loop?

The human comes in at three moments automation does not cover: at the start, defining the mission and what is out of bounds; during, approving sensitive actions and interpreting ambiguity that requires business context; and at the end, validating evidence, rating severity by impact, and signing off on the result. This is the human-in-the-loop model, and it is not a formality.

The reason is technical, not merely governance. An agent excels at reach and chaining, but it does not carry the business context that decides whether a finding is critical or irrelevant — whether an exposed flow is a serious flaw or expected product behavior. Nor should it be the one deciding to run an irreversible action in production. That is why the architecture includes checkpoints, a cost ceiling, and a circuit breaker that halts the operation when a parameter goes off-plan. The agent proposes; the specialist disposes.

This balance connects directly to AI governance. Running offensive agents with scope, approval, and an audit trail is exactly the kind of control that standards such as ISO 42001 expect from anyone operating AI responsibly — and it is how an information security company in São Paulo demonstrates that the machine's autonomy stays under verifiable human control.

What are the limits of an agentic pentest?

The main limit is judgment: an agent does not replace the specialist in interpreting ambiguous business logic, in the final prioritization by impact, or in technical accountability for the result. It extends the reach of the investigation, but the meaning of what it finds is still decided by a person. Acknowledging this is what separates a mature use of agents from a promise of a "100% automatic pentest."

There are other concrete limits that set expectations:

• Business context. The agent does not know the value of a piece of data or a flow unless the mission defines it. A poorly described crown jewel produces a poorly directed investigation.
• Sensitive environments. Irreversible actions, critical production systems, and regulated data require human approval and, often, execution restricted to the client's tenant.
• False positives. Like any automated system, an agent generates noise; the verification phase and human validation exist precisely to filter it before the report.
• Coverage is not a guarantee. Reaching more routes than a manual test does not mean reaching all of them. The agent reduces the blind spot; it does not eliminate it.

Treated as a tool under specialist direction, not as a replacement for the specialist, agents raise the ceiling of what a penetration test covers in the same amount of time. That is the proposition: more reach, the same human accountability.

Frequently asked questions

Does an agentic pentest replace the human pentester?

No. The agent extends the reach of the investigation — covering more routes and chaining more conditions in the same time — but the specialist still defines the mission, approves sensitive actions, interprets business logic, and signs off on the result. The model is human-in-the-loop: the machine proposes, the person decides.

What is the difference between an autonomous scanner and an agent?

A scanner runs a fixed battery of checks and returns a list, without chaining findings. An agent holds an objective, interprets the result of each action, and reformulates the next hypothesis, preserving identity and state across surfaces. The difference is agency: deciding the next step, not just executing it.

Is an agentic pentest safe to run in production?

Yes, when it operates under approved scope and with adequate controls. Autonomy is proportional to risk: sensitive actions require approval, irreversible operations can be blocked, and a circuit breaker halts execution outside the plan. Every step is recorded with logs, evidence, and replay for audit.

The agentic pentest is the model behind Berghem Agents and our Red Team exercises. To discuss applying it in your environment, talk to the team.