Home / How it works
How the testing is delivered
A consultant directs every stage of the work, with automation running the continuous load alongside them. This page sets out who does what, and how the boundaries that tooling runs within are enforced.
The division of labour
Agents provide coverage at a scale and frequency a human team could not sustain. Consultants direct the testing, do the work that requires judgement, and are accountable for what we send you. Read the table as two columns of one engagement, not two alternative services. A consultant directs every phase and owns the ones that need judgement.
| Phase | Agentic AI | Human consultant |
|---|---|---|
| Scope definition and authorisation | Not involved | Defines and verifies scope, and configures the boundaries agents run within |
| Discovery and enumeration | Continuous, across all in-scope assets | Directs where to look, and reviews every new asset found |
| Vulnerability identification | Runs the repeatable checks, continuously | Tests by hand, directs focus, adjusts priorities |
| Correlation and prioritisation | Drafts | Decides |
| Exploitation and chaining | Constrained, non-destructive only | Performs the exploitation, and chains findings into attack paths |
| Validation | Not involved | Reproduces or confirms every finding |
| Reporting | Drafts | Writes, signs, is accountable |
Two rows are worth noting. Validation has no agent column, because a finding is not reported until a consultant has reproduced or confirmed it. Reporting has a named consultant against it, so there is someone answerable for the document you take to your board.
Guardrails, and who enforces them
Human oversight here is a safety control as well as a quality control. Testing tools can reach the wrong host and can break things, and an agent working quickly can do either faster than a person would. The boundaries are therefore set by consultants and enforced technically rather than by instruction.
- Scope is enforced at the network layer, not by instruction. Out-of-scope targets cannot be reached, so an error in an agent's reasoning cannot become an error in what it touches.
- Destructive actions, denial-of-service and credential attacks are blocked by default. Where a test genuinely requires one of these, it is run by a consultant, deliberately, with your written agreement first.
- Every command an agent runs is logged. The logs are kept at command level and are available to you on request.
- A consultant reviews agent activity as part of each reporting cycle. The activity itself, not only the findings that came out of it.
- Domain ownership and written authorisation are verified manually before any testing begins. There is no self-serve path.
What command-level logging looks like
Agent activity is recorded as the commands issued, with a timestamp and the target. The extract below is illustrative, using sample data.
2026-09-14T02:14:07Z scope-check host=app.example.com in-scope=yes 2026-09-14T02:14:07Z discover host=app.example.com ports=443,8443 2026-09-14T02:15:22Z identify host=app.example.com finding=candidate:TLS-config 2026-09-14T02:15:48Z scope-check host=vendor.example.net in-scope=no action=blocked 2026-09-14T02:16:03Z exploit-check host=app.example.com class=non-destructive 2026-09-14T02:16:04Z exploit-check class=credential-attack action=blocked-by-policy 2026-09-14T02:31:10Z queue finding=candidate:TLS-config state=awaiting-human-validation
The fourth and sixth lines show the guardrails working: an out-of-scope host was refused, and a class of attack blocked by policy was refused, without anyone needing to intervene in the moment.
What a month looks like
Discovery and exposure checks run on the most frequent interval in your schedule, because they are how new assets and new openings get noticed. Module work runs on a defined rotation. When something interesting surfaces, a consultant directs effort towards it rather than waiting for the next interval, which is why coverage varies between cycles rather than repeating identically.
Critical and high findings are notified within one business day of validation, outside the reporting cycle. Everything else arrives in the monthly report, along with what changed since the last one and the status of fixes you have applied. Once a quarter we go through it with you properly on a call.
Notification targets are set in business days. This is not a round-the-clock monitored service.