Skip to main content
B‑52
Run a scan
B-52 · Agentic Penetration Testing Platform

AI penetration testing, built from every manual audit since 2006

B-52 maps an application, works out the test cases that application needs, tries them, proves what it finds and writes the result up. Whether any of that is worth reading is not decided by the autonomy. It is decided by what the autonomy was taught.

One thing before anything else, because the phrase points in two directions. This page is about autonomy testing your software. Testing an AI application — a prompt, a model endpoint, an agent that can call tools — is a separate job that B-52 also does, and it is not what follows here.

See what happens on a run See it run against a mobile binary

Two jobs, one phrase

“AI pentest” means two different things

Search the term and both come back, mixed together on the same page of results. They need different scopes, different evidence and different people to sign them, so it is worth being exact about which one you are reading.

The two things the term is used for
The readingWhat the work actually isWhere it lives
Autonomy doing the testing A platform maps your application, works out the test cases that application needs, tries them, proves what it can and writes the result up. A person authorises the scope; in the fully autonomous model that is the only human action in the engagement. This page, and what B-52 is.
Testing an AI application Prompt injection and jailbreak testing of an LLM application, security of the model endpoint and the API in front of it, and agentic systems where the tool call is the attack surface. One of the eleven coverage classes. A different job, and a different page.
Key
  • The subject of this page
  • A capability B-52 also carries, covered elsewhere

Both are ours. Only the first one is this page, and everything below it describes a platform pointed at ordinary software — a web application, an API, a mobile binary, a network, a directory.

What is inside the platform

Where the quality of an AI pentest actually comes from

Anyone can point a model at an application and call what comes back a penetration test. What actually comes back depends on two things — what the model was shown, and what it was told to do with it. Both of those are ours, and both have been accumulating since 2006.

01 The corpus

Every assessment since 2006, kept rather than filed away

Where it came from
Security Brigade has been CERT-In empanelled since 2008, and every assessment the firm has run since it started in 2006 was worked inside Lemon, our own assessment platform, so the reasoning behind a finding stayed attached to the finding instead of leaving with the auditor who wrote it.
What it holds
6,700+ assessments worth of test cases, the vulnerabilities those test cases turned up, and the threat models they were derived from. That count is held in Lemon.
Why this is the half that matters
Advisory text teaches a tester what has already been written up somewhere. Assessment records teach it what our own auditors went looking for on applications like yours, and which of those guesses turned out to be right.
02 The harness

It works the way our senior auditors work

What it reproduces
Mindmap creation, test-case generation, comprehensive JavaScript analysis and functional flow analysis. Those four are what a Security Brigade auditor moves through on an application, and the harness was written to run them rather than to run a check list.
Where autonomy changes it
A person works the highest-value part of a generated test set, because the engagement has an end date and they do not get to the rest. The platform has no end date, so the set is worked through. The same four practices then run the same way on the next target, at whatever cadence your releases ship.
What comes out of the pair
A test plan derived from what your application does, rather than a profile selected from what it appears to have been built with.

The four practices, and what each one answers first

These are not pipeline stages. They are four things an auditor settles about an application before attacking it, and each one narrows what the next is allowed to spend time on.

The auditor practices the B-52 harness reproduces, and what each settles
Auditor practiceWhat it settles before the first exploit attempt
Mindmap creation Which entry points exist, which roles reach them, and where one role can touch another role’s data. It is the step that makes an assessment specific to your application rather than specific to your framework.
Test-case generation The checks this application needs, derived from what it does. A payments flow and a document workspace have almost nothing worth testing in common once the boilerplate is out of the way.
Comprehensive JavaScript analysis The routes, parameters and endpoints the interface never links to. An assessment that follows links stops at the edge of the menu, and the interesting handlers are usually past it.
Functional flow analysis Multi-step flows and the state they carry — what happens when the steps are taken out of order, replayed, or taken by the wrong role. Business logic is not a pattern match, so none of this falls out of a signature.

The auditor practices the B-52 harness reproduces, and what each settles

Mindmap creation

What it settles before the first exploit attempt
Which entry points exist, which roles reach them, and where one role can touch another role’s data. It is the step that makes an assessment specific to your application rather than specific to your framework.

Test-case generation

What it settles before the first exploit attempt
The checks this application needs, derived from what it does. A payments flow and a document workspace have almost nothing worth testing in common once the boilerplate is out of the way.

Comprehensive JavaScript analysis

What it settles before the first exploit attempt
The routes, parameters and endpoints the interface never links to. An assessment that follows links stops at the edge of the menu, and the interesting handlers are usually past it.

Functional flow analysis

What it settles before the first exploit attempt
Multi-step flows and the state they carry — what happens when the steps are taken out of order, replayed, or taken by the wrong role. Business logic is not a pattern match, so none of this falls out of a signature.

What it scored against people

Run beside our own assessment team, against the same targets

The benchmark that settled this internally was not a public leaderboard. B-52 was run in parallel with Security Brigade’s own expert assessment team, against the same targets, and the two sets of findings were laid side by side.

B-52 reached 90–95% of the combined findings set, and it surfaced issues the human team did not. The second half of that sentence is the one worth sitting with: the overlap runs short in both directions, which is why the combined set is larger than either party’s own.

It is also the honest argument for keeping an auditor in the engagement when the output has to be signed by one. Platform and assessor together read more of an application than either reads alone, and that is a result about coverage rather than a compliment to anybody.

How the parallel benchmark was measured
  • B-52 and Security Brigade’s expert assessment team worked the same targets at the same time.
  • The denominator is the combined findings set — everything either party found, each item counted once.
  • B-52 reached 90–95% of that set.
  • Part of what B-52 found was absent from the human team’s set, which is what makes the combined set larger than either one of them.

Where the human is

Scope sign-off, then nothing — with three actions that stop and wait

Autonomy is a claim about who does the work, and it is only worth anything if the boundary is stated precisely enough to argue with. Here is the whole of it, in order.

  1. Before

    You authorise the scope

    Targets, boundaries and the delivery model. That is the last thing the run needs from you, and in the fully autonomous model it is the only thing it ever needed.

  2. During

    It works without asking

    Discovery, planning, scanning, exploitation, reporting, and a QA gate that sits after reporting rather than before it. Nothing waits on an assessor’s calendar and nothing waits for a hand-off between phases.

  3. Exception

    Three actions stop for written approval

    Destructive or state-changing actions in production. Persistence, implants and lateral movement past the entry host. Anything that touches live credentials or real customer data. Approve one for a scope and the platform carries it out itself.

  4. Output

    Every finding arrives with the exploit that produced it

    The request, the response and the steps to reproduce it, in all three delivery models. If your engineers cannot run it again themselves, it is a claim rather than a finding.

  5. Autonomous only

    And then a second gate before you see it

    In the fully autonomous model, findings additionally pass an independent automated cross-check before they are reported. The exploit is what makes a finding checkable by you; the cross-check runs before it reaches you at all.

Choosing where the human sits

Three delivery models are on offer: fully autonomous, autonomous with a senior auditor verifying every finding, and human led with B-52 running underneath. They change who stands behind the findings, not which of the eleven coverage classes get worked.

If the assessment is going to a regulator, take one of the two models with an empanelled auditor in it. CERT-In empanelment attaches to the firm and is a condition of the testing itself, so the auditor’s involvement is what makes the output filable.

Persistence is worth one more sentence, because it is the part people assume a person must do. Once it is approved for a scope, the platform establishes it. There is no point in the run where somebody takes over to do the difficult half.

The six phases, and what leaves each one

Point it at one application and read what comes back

One scan covers one application or one target. Pricing opens at $500 and the whole ladder is published, so you can size this yourself before you speak to anybody.

See the platform in full Read a capability page in full