MAGE

AI in our security assessments, led by our analysts.

MAGE is the harness we built to make our analysts faster with AI. The analyst decides where to look, which leads to follow, and what to try next. MAGE does the grunt work: discovery, static and dynamic analysis, and the many exploitation attempts in between. The analyst stays in the loop throughout and decides what counts as a finding.

Exploits, Not Just Scan Results

MAGE drives a real browser to turn a suspected vulnerability into a working proof of concept, like the SQL injection in the screenshots below, instead of stopping at a scanner match.

The Grunt Work Runs in the Background

The analyst points MAGE at a target, and it runs code analysis, scanners, and exploitation attempts in parallel, including queries on the code property graph with Joern. The analyst’s time goes to the parts of your application that need a human.

Every Finding Is Proven and Reviewed

Each suspected finding must be proven exploitable by one agent, and the proof is checked independently by others. An analyst then reviews it. Nothing reaches your report without that review.

Evidence Recorded Unaltered

Every tool run is recorded exactly as it happened, with its command, arguments, and output, without passing through a language model. Each finding keeps its history from detection to validated proof of concept, so your developers can follow and reproduce it.

MAGE's action log next to a live browser exploiting a SQL injection vulnerability in a WebGoat lesson — Live exploitation

Timeline tracking a finding from detection through a validated proof of concept — Evidence and audit trail

Work queue showing running, queued, and completed exploitation and code analysis jobs — Work queue

Why the Analyst Leads

In one of our first assessments with MAGE, the agent found nothing of note during discovery. The analyst, reading through its logs, noticed something, followed it up together with the agent, and found a significant privilege escalation that the model had missed. That is the division of labor we built MAGE for: the machine covers ground quickly, and the analyst brings the curiosity and judgment. We call this cyborg pentesting, inspired by the paper Think Cyborg, Not Robot.

Your Code Stays Where You Want It

Whether AI is used in your assessment, and which inference provider processes your code, is agreed with you in writing. MAGE can run on the inference you choose, such as your own cloud account or a local GPU cluster, so an assessment does not spread your data further than you are comfortable with.

Part of Our Assessments

MAGE is not a separate product. It is available on any of our security assessments when you want AI in your testing, and works alongside the way we work with your developers. Read how we built it.

See MAGE in Your Assessment

Tell us what you are building, and whether you want AI in your testing. We reply within one business day.