PortSwigger’s Burp AT lets enterprises delegate pentests with defined limits
PortSwigger has announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often.
Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger Research, and relevant application context. Agents plan their testing approach, use Burp’s web security testing tools, and adapt as they learn.
For AppSec leaders balancing testing priorities with limited expert capacity, Burp AT helps teams pursue investigations that would otherwise wait, revisit applications as they change, and carry out in-depth testing more often, over more of their estate.
Security teams choose how much authority to delegate, from guided investigations to autonomous execution of defined tests. Burp deterministically enforces configured scope and permissions, not the model itself, while experts assess the evidence to decide which weaknesses to address and where further investigation is needed.
“Pentesters have shown what agentic testing can do on a single application with Burp AT,” said Chris Wood, Product Manager at PortSwigger. “The question for security teams is how to bring that to a whole application estate without losing control. Burp AT now lets teams run agentic tests at scale, with the scope and safeguards set in advance, whilst ensuring that teams can stop and see what the agent is doing. Teams get that depth across more of their applications, with control built in.”
Testing with specialist tools and research-led methods
Burp AT helps teams bring specialist testing depth to more applications, equipping agents with the Burp tools professional pentesters use and purpose-built skills developed with PortSwigger Research.
The specialist tools are designed to handle malformed traffic and unusual behaviour that is inherent to security testing. Research-led skills give agents structured methods to pursue promising leads and adapt to the evidence, so organisations get consistent, comparable results across every application they test.
“The best results from agentic testing come from giving agents the right tools, not just a capable model,” said Tom Shelton-Lefley, Product Manager at PortSwigger.
“Burp AT lets agents use Burp’s specialist tools autonomously, guided by workflows our researchers have tested in practice. In Burp AT, an orchestration layer ties those tools together into a complete test that helps agents remain consistent across tests by following defined pentesting methodologies. The agent brings the reasoning, and Burp brings the precision, which is how autonomous testing delivers the depth teams need.”
Autonomy on the organisation’s terms
Organisations choose how much testing to automate and where their teams stay closely involved, from user-guided to autonomous execution of defined tests. Teams can increase or reduce the authority they delegate according to the application, task, and organisation’s risk appetite, whilst retaining the ability to step in when needed.
Whatever level of autonomy you choose, Burp enforces configured scope and permissions, not the model itself, meaning agents cannot execute actions the tooling layer does not permit, thus maintaining testing boundaries as more execution is delegated. Teams retain visibility into test activity and the evidence behind findings, giving them the oversight to assess results and make decisions about risk.
