Agents cover ground no fixed-hour engagement could reach. People decide what any of it means. Here is exactly how that division works.
The distinction that matters is not what is automated — it is what is trusted without review.
Five stages. You know at each point what is happening and what you get from it.
Human · Step 1
We agree in writing what is in bounds, what is out, and what may never be touched. Nothing runs before this is settled.
Agent · Step 2
Agents map every host, service and endpoint in scope, then keep that map current for the duration of the engagement.
Agent · Step 3
Agents probe for known weakness classes across the whole surface and collect the evidence a person needs to judge each candidate.
Human · Step 4
An engineer reproduces every candidate by hand, chains individually minor issues into paths that matter, and discards what cannot be exploited here.
Human · Step 5
You get the written findings, and once your fixes land we retest to confirm they hold.
Certifications held across the team
Agents surface candidates continuously. Each one waits for a person before it becomes a finding.
enumerating subdomains
fingerprinting services
auth bypass candidate — /api/v2/session
chained privilege escalation — admin to root
queued for human verification
verified and written up by an engineer
If a person has not reproduced it, it does not go in the report. Scanner output is an input to our work, never a deliverable.
Nothing runs against a system that is not in the agreed scope, and nothing destructive runs without explicit sign-off.
You are buying an outcome and a report, not a dependency. Everything we set up in your pipeline is yours and runs without us.