AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving

AI Pentesting Is Live: The Layer That Stops Flagging and Starts Proving

Everything else Decloak does, the 8 core layers, Active Testing, is signal detection. It observes, it probes gently, and it flags things that look wrong. AI Pentesting is a different kind of layer entirely: it's the one that actually attempts exploitation, inside a sandbox, and only reports something as confirmed once a real tool has proven it works, not pattern-matched it into looking plausible.

It's live now, Enterprise only, opt-in, and runs as a second, independently-timed phase after the rest of a scan completes.

A fixed toolkit, not an AI improvising attacks

This is the design choice worth understanding before anything else about how it works. Every target AI Pentesting tests comes from a finding the rest of the scan already produced, a reflected-input parameter, a discovered API endpoint, a page with a form, a confirmed exposed file, a JWT spotted while crawling. Nothing gets invented mid-scan by a model deciding on the fly what to attack.

That constraint is what makes the consent checkbox mean something. It's also what makes every run auditable and reproducible, you can look at exactly what was targeted and why, because the target list was deterministic before testing ever began.

Five real tools, each mapped to a specific signal

• sqlmap - SQL injection, tested both via URL parameters and via --forms mode against login, contact, and search forms.
• dalfox - cross-site scripting, with real payload execution verified, not just a reflection observed and assumed exploitable.
• ffuf - hidden parameter discovery using a curated wordlist.
• nuclei - deepens findings on already-confirmed exposed files and paths using signature-based misconfiguration templates.
• jwt_tool - offline weak-secret cracking against any JWT spotted while crawling.

Worth being precise about that last one: jwt_tool never attempts live tamper-and-replay against a real endpoint here, cracking only, by design. There's no reliable live session to replay against in this decoupled phase, and a replay attempt that actually works carries real consequences on a production system. Cracking a weak secret offline proves the same underlying weakness without that risk.

Sandboxed, with two independent layers of containment

Each tool run gets its own fresh, ephemeral sandbox, destroyed immediately after the run completes. Network egress is scoped by an independent layer we built ourselves, an in-sandbox egress-filtering proxy that only allows traffic to the one target domain being tested, enforced inside the sandbox regardless of what the underlying platform does.

Every confirmed finding carries proof, the exact request and response that demonstrated it, not a description of what should theoretically happen.

Every outcome is shown, never just the successes

A check can land in one of five states, and each is visually distinct in the report:

• Confirmed - real proof, request and response included.
• Signal - a heuristic hit worth a look, explicitly not proof.
• Clean - genuinely tested, nothing found.
• Inconclusive - blocked by a WAF, a TLS failure, something got in the way. Never shown as if it were a clean pass, because it isn't one.
• Not-applicable - nothing on the site matched what that specific tool looks for, so it never ran, explained in plain language rather than silently omitted.

That last distinction matters more than it might seem. A tool that's simply missing with no explanation looks like a gap. A tool marked not-applicable, with the reason stated, looks like exactly what it is, a check that correctly determined it had nothing to test.

Consent, twice

Beyond Active Testing's own consent, AI Pentesting requires a second, explicit checkbox, naming specifically that real exploitation attempts, not just detection, will run. Every test remains non-destructive by design regardless: confirmation is response-signature-based, timing, status codes, error strings, never data extraction or mutation. Proving a SQL injection is exploitable doesn't require actually pulling data through it.

Scoring and reporting

• An independent Pentest Score, separate from both the main security score and the Active Testing score, never blended into either. Shown as its own gauge, in the report header once complete (with a live "pending" state while it's still running), and again in a dedicated tab.
• A dedicated Pentesting tab, sitting right after Active Testing in the report.
• A standalone Pentest Report PDF, separate from both the main report and the DAST report, including full proof-of-exploit evidence.
• Bundled automatically into the Evidence Package ZIP alongside your other reports, no separate export step needed.

What this doesn't do yet, stated plainly

It currently confirms SQL injection and cross-site scripting with real proof, plus narrower signal-only work: hidden parameter discovery, deepening on already-exposed files, and JWT weak-secret cracking. It does not yet attempt SSRF, XXE, command injection, CSRF, IDOR/BOLA, or several other vulnerability classes some competitors claim broader coverage of. The honest framing is real confirmation for the classes it covers, not a full penetration-test-equivalent sweep. We'd rather say that plainly than have you find the boundary the hard way.

Availability

Enterprise plan only, on top of Active Testing, gated by its own consent checkbox per scan. If you're on a lower tier, you'll see a locked teaser naming all six checks directly in your report, so it's visible as an option even before you need it.

AI Pentesting is available on Decloak Enterprise. See plans →