Methodology
How an autonomous penetration test works
AQIRA runs five phases in attacker order, one agent to each, then writes the report; every finding carries its evidence, and that evidence is benign. Below: each phase, what a finding carries, and where an assessment stops.
Five phases in attacker order, then the report
Five agents own the phases, each handing results to the next, and SCRIBE writes the report; the work inside each phase changes with the input.
ORIONRecon
Maps the public attack surface.
On a domain it works outward through certificate transparency and passive DNS to every subdomain, host, service and API reachable from the internet. On other inputs it inventories the package, account, repository or tenant first.
VEGAWeb
Probes web and API input handling, sessions and headers.
On a domain it tests input handling, sessions and headers in each web app and API. On a repository it traces tainted input; on a tenant it reads identity and workload policy.
ATLASInfra
Assesses cloud, transport and the internal segment.
On a domain it checks transport and the cloud resources behind it. On a cloud account it reviews logging, storage and network; on an Android app it inventories bundled SDKs and reviews cryptography.
NOVAExploit
Validates exploitability to benign proof.
It validates what the others found to benign proof and records the steps your team can repeat.
POLARISReview
Consolidates findings and maps them to control frameworks.
It consolidates findings and maps each to the controls it touches. It then scores the input against its framework: OWASP Top 10 and NIST for a domain, MASVS for an Android app, CIS for a cloud account, CIS and CISA SCuBA for a tenant.
SCRIBEReport
Writes the client-deliverable report.
It writes the client-deliverable report from the same evidence the console shows, in the chosen template.
Each input's phase names are on the platform page; each input also has a page of its own.
Reconnaissance, Standard, Deep
How far an assessment goes
The intensity is set when an assessment starts, where the input offers a choice. None is destructive.
- Reconnaissance
- Maps the attack surface without exploitation. No authorisation needed.
- Standard
- Active testing with safe, non-destructive proofs of concept.
- Deep
- Chained, in-depth exploitation to prove impact. Still non-destructive.
Which inputs offer which is in the platform's intensity table.
What a finding carries
Each finding opens on four tabs, written for the different people who read it.
Evidence and PoC
The request and the response
What AQIRA sent and what came back, with the benign marker, delay or lookup that proves it, and the CVSS vector behind the score.
Reproduce
Steps your team can repeat
Read-only steps in order, each with the request to send and the response to expect, to confirm the finding before the fix and after it.
Remediation
A fix list in priority order
Contain it now, fix the root cause, then harden. Every step has a priority and an effort.
Mappings
Mapped for every reader
The ATT&CK technique and MITRE's mitigations, the CWE and OWASP category, and the controls it touches.
- Confidence
- High, Medium or Low: how sure AQIRA is that the finding is real.
- Severity
- Critical to Info, with the CVSS 3.1 vector behind the score where one applies.
- Status
- Open, In remediation, Accepted risk, Resolved or False positive. Your team sets it; the audit trail records who did.
One finding from the demo assessment of acme.example, tab by tab, is on the platform page.
How proof stays benign
AQIRA proves a weakness with the smallest evidence that shows it is real, without taking data or changing anything.
Benign markers
Proof is a unique marker the target echoes back, a measured delay, an out-of-band lookup or the output of a read-only command.
Non-destructive at every intensity
Standard runs safe proofs of concept; Deep chains steps to prove impact, still non-destructive; Reconnaissance sends no attacks.
Steps your team can repeat
Each finding lists read-only steps to reproduce it, with the response to expect.
Authorised targets only
Every active assessment and every schedule starts with the operator confirming they are authorised to test the target.
You can stop it
Pause, resume or cancel any assessment from the live console; it holds or stops at the next safe checkpoint. Schedules pause and resume too.
ATT&CK, CWE, control frameworks
One finding, read by three teams
POLARIS maps each finding three ways: for the SOC, whether they would see it; for developers, where the fix goes; for auditors, which control failed.
- MITRE ATT&CK
- The technique a finding gives an attacker, on the Enterprise matrix, in kill chains by tactic, with MITRE's own mitigations. The console carries 416 techniques and sub-techniques from MITRE ATT&CK v15.1.
- Weakness
- The CWE and the OWASP Top 10 category: the class of problem, for developers. Code findings are grouped by CWE.
- Controls
- The controls a finding touches, in the frameworks that apply to its input (12 in all), and OWASP MASVS scoring for Android apps:
- OWASP Top 10
- NIST CSF 2.0
- NIST SP 800-53
- NIST SP 800-171
- COBIT
- CIS AWS
- CIS Azure
- CIS GCP
- CIS Microsoft 365
- CISA SCuBA (M365)
- CIS Google Workspace
- CISA SCuBA (GWS)
- OWASP MASVS
What an assessment does not tell you
A clean result means the checks AQIRA ran found nothing on that target, at that moment. It is not a statement that an estate is secure.
It is not a penetration test with a person in it.
A clean assessment states what was tested, at one moment, not that an estate is secure.
It does not find business logic flaws.
Those need someone who understands what the application is for.
It does not test behind a web login.
Web and API assessments cover what the internet reaches without signing in.
It does not assess people.
No phishing, no social engineering and no physical access testing.
It does not reach internal networks on its own.
Only through a collector you install, and only the private networks you authorise.
It does not ask for write access.
Read-only roles, tokens and consent, granted and revocable on your side.
It assesses Android apps, not iOS apps.
Mobile assessments take an Android package (APK) and map findings to OWASP MASVS.
Next step
A demo of the methodology
A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.