Skip to content

Guardrails

These are the controls that keep an AI Network Pentesting assessment bounded: what it may attempt, how hard it hits your hosts, how long it runs, and how to stop it.

Attack Vectors

The strongest control is the vector selection. Safe vectors only observe. Intrusive vectors try credentials, send payloads, exploit known CVEs, or send repeated requests. See Attack Vectors.

Rate Limit

In Fine-Tune (Optional) > Duration, set Rate limit (req/s) from 10 to 100. The default is 20.

The limit caps how many requests per second the assessment sends to your targets. Keep it at the default for production or capacity-sensitive hosts, and raise it when the targets absorb more traffic.

Max Duration

In the same section, set Max duration from 6 to 24 hours. The default is 10 hours.

The assessment stops when it reaches the limit. Cancellation or a failure ends it sooner.

Schedule

In Fine-Tune (Optional) > Schedule, start the assessment now or pick a later start time. Use it to run intrusive vectors inside a test window you've agreed on with the service owners.

Stop an Assessment

  • One assessment: cancel it from the assessment page. Other assessments keep running.
  • Every assessment: organization administrators can turn on Cancel all current AI Pentesting scans and prevent all AI Pentesting scans from being started in Organization Settings > Scan Kill Switches. While it's on, no AI Network Pentesting assessment starts. See AI Pentesting Guardrails.

Allowlisting and Identifying Escape Traffic

Assessments run from the location you pick in Fine-Tune (Optional) > Location. To recognize or allowlist that traffic in your firewall, IPS, or SIEM, use the source IP addresses on Firewall Configuration. With a private location, traffic comes from that location's egress IP.

Port scans and most network probes carry no HTTP header, so match on the source IP, not on Sec-Escape-User.

Built-In Safety Rules

These rules apply to every agent, whatever you select:

  • No destructive or irreversible operation against a target: no data deletion, no configuration change, no denial of service.
  • Credential checks stay bounded: a handful of vendor-documented pairs for the fingerprinted product, tried one at a time, stopping at the first success.
  • Injections are proven with read-only oracles.
  • Denial-of-service CVEs are reported, never run.
  • Agents name every service they authenticated against and every account they touched, so you know what to unlock if anything locked.