Features

Explore reachable web and API surfaces, review the evidence and track what remains untested.

Not another checkbox scanner

Agent Breach uses scan evidence to select from its security-testing catalog, review possible attack paths and explain remediation. Available checks depend on profile, scope and reachable surfaces.

See detailed vendor comparisons in our FAQ →

Why not traditional DAST alone?

  • Signature scanners can list isolated findings; our attack graph connects supported observations for review.
  • Authenticated surfaces (OAuth, SAML, API keys) are first-class—not an afterthought.
  • OpenAPI import, GraphQL depth, workflow logic, and second-order validation go beyond template replay.
  • AI orchestration can coordinate selected capabilities in scheduled and CI-triggered scans.

Automated DAST scanning

Dynamic application security testing with selected Nuclei, Nikto, OpenAPI-aware and GraphQL checks on reachable surfaces.

  • Checks mapped to OWASP Top 10 risk categories
  • OpenAPI discovery & schema-aware API fuzzing
  • GraphQL depth, alias & batch abuse testing

Detailed reporting

Export findings in multiple formats with actionable remediation guidance.

  • PDF, JSON & CSV exports
  • Executive summaries
  • Proof-of-concept included

Built for pentest providers and security consultancies: on paid plans, you can add your company logo and business name to reports before sending them to your clients.

Replayed lab evidence

Authenticated testing

Test protected endpoints with multiple authentication methods and dedicated OAuth/OIDC security scanning.

  • OAuth 2.0, OIDC & SAML support
  • Cross-profile BOLA testing
  • OAuth redirect_uri & PKCE validation

Attack graph analysis

Visualize exploit chains and dependency mapping between vulnerabilities.

  • Dependency mapping
  • Risk prioritization
  • Impact assessment

Framework-mapped reports

Export recorded findings and framework mappings for GRC review. Mappings do not establish compliance or certify your environment.

  • Executive, developer, and standards PDF templates (OWASP, NIST, CREST, PCI-DSS ASV-style, CIS Controls)
  • Full-matrix framework mapping JSON and Evidence Pack ZIP on Team and higher (HIPAA/PCI only when applicable to the app)
  • Retest appendix with fix-verification outcomes

Phishing simulations

Enterprise consent-gated social engineering campaigns—cloud-only, DNS-verified, with AI-drafted email templates.

  • CSV recipient import & tracked landing pages
  • Open, click, and submit metrics
  • Included in engagement report appendix

Fix verification & retest

Replay a finding's proof-of-concept after remediation to confirm it is actually fixed—not just marked closed.

  • One-click verify-fix from the finding page
  • Verified fixed / still vulnerable / inconclusive status
  • Retest outcomes in PDF report appendix

Engagement health dashboard

Per-target program metrics so security and engineering leaders see coverage and risk at a glance.

  • Latest scan coverage percentage
  • Confirmed vs reported finding ratio
  • Open critical/high count & modules in scope

Daily threat intelligence

We turn the latest public vulnerability findings into structured advisories that feed the AI attacker and alert you when your stack may be affected.

  • Knowledge refreshed daily from world findings
  • Stack-matched alerts on your targets
  • Optional safe verification scan in one click
Start free scan