PortSwigger Launches Burp AT for Enterprise Agentic Penetration Testing
PortSwigger introduces Burp AT, an agentic penetration testing solution designed to empower enterprises with deeper, more frequent application security assessments.
PortSwigger has announced the general availability of Burp AT for enterprises, a new agentic penetration testing solution aimed at enabling security teams to conduct more thorough and frequent security assessments of their critical applications.
Burp AT integrates specialized Burp tools with purpose-built pentesting skills derived from PortSwigger Research, combined with contextual application information. The system allows security agents to autonomously plan their testing approach, utilize Burp's extensive web security testing capabilities, and adapt their strategies as they gather information and learn about the target application.
This solution addresses a key challenge for Application Security leaders who often face difficulties balancing testing priorities with limited expert capacity. Burp AT is designed to help these teams pursue investigations that might otherwise be postponed, revisit applications as they evolve, and perform in-depth testing more frequently across a larger portion of their digital estate.
Organizations can precisely control the level of authority delegated to the agents, ranging from guided investigations where human oversight is constant, to fully autonomous execution of predefined tests. Burp AT deterministically enforces the configured scope and permissions, ensuring that the agents operate within defined boundaries. Security experts retain the crucial role of assessing the evidence and deciding which weaknesses require remediation and where further investigation is warranted.
"Pentesters have shown what agentic testing can do on a single application with Burp AT," stated Chris Wood, Product Manager at PortSwigger. "The question for security teams is how to bring that to a whole application estate without losing control. Burp AT now lets teams run agentic tests at scale, with the scope and safeguards set in advance, whilst ensuring that teams can stop and see what the agent is doing. Teams get that depth across more of their applications, with control built in."
The platform equips agents with the same specialized Burp tools used by professional penetration testers, augmented by research-led skills developed by PortSwigger Research. These tools are engineered to handle malformed traffic and unusual behaviors inherent in security testing, while the research-led skills provide structured methodologies for pursuing promising leads and adapting to discovered evidence, ensuring consistent and comparable results across all tested applications.
"The best results from agentic testing come from giving agents the right tools, not just a capable model," added Tom Shelton-Lefley, Product Manager at PortSwigger. "Burp AT lets agents use Burp’s specialist tools autonomously, guided by workflows our researchers have tested in practice. In Burp AT, an orchestration layer ties those tools together into a complete test that helps agents remain consistent across tests by following defined pentesting methodologies. The agent brings the reasoning, and Burp brings the precision, which is how autonomous testing delivers the depth teams need."
Organizations have the flexibility to choose the extent of automation and the level of team involvement, from user-guided operations to fully autonomous execution of defined tests. This allows teams to adjust the delegated authority based on the specific application, task, and the organization's risk appetite, with the ability to intervene at any point. Regardless of the chosen autonomy level, Burp enforces configured scope and permissions, preventing agents from executing actions outside permitted boundaries, thereby maintaining testing integrity as delegation increases. Teams maintain full visibility into test activities and the evidence supporting findings, enabling informed decision-making regarding risk.