Skip to main content

Agent Cockpit & Attack Trace

Path: /scans/[id]

Two surfaces turn a DAST run from a progress bar into a pentest you can follow and defend: the Agent Cockpit (live, while the scan runs) and the Attack Trace (per finding, after the agent proves it).

The Agent Cockpit (live)​

While the autonomous pentest runs, the scan detail page narrates it in the first person instead of scrolling a raw event log.

  • Agent now - a single intent line that updates as the agent reasons: what it is trying, on which endpoint, and why.
  • Task tree - the phases of the engagement (crawl, active scan, agent pentest and its sub-steps), each with a status and an engine badge showing which engine is working.
  • Live kill-chain - the capabilities the agent has proven so far, stitched into a chain that grows in real time (entry → execute → credential → privesc → pivot → impact).
  • Narrated activity - typed tool-call cards and conversational reactions to each probe's result ("that 500 with a SQL error is a strong tell - escalating to a timing proof").
  • SAFE trust signal - a visible marker while non-destructive checks run, so a viewer can see the engine is probing with benign markers, not real exploits.

The cockpit is read-only and updates live; the scan continues if you navigate away.

The Attack Trace (per finding)​

When the agent confirms a finding, the vulnerability leads with an Attack Trace rather than a bare severity score:

  • Numbered agent steps - the exact sequence the agent took to prove it, in order.
  • Status chips - Validated (the adjudicator confirmed it), Working exploit (a proof-of-exploit interaction exists), and SAFE (proven with benign markers, no destructive action).
  • Masked proof receipt - the request/response evidence, with any sensitive material (credentials, keys) masked.
  • Proven Impact - what the attacker actually gains, in plain language ("reads invoices belonging to other tenants"), not a generic CVSS description.

Because the trace is built from the real adjudicated steps, it is the strongest prioritisation signal in the platform: a proven chain outranks a pile of theoretical highs.

Cross-finding chains​

The Attack Trace is where the engine's cross-finding chaining shows up: a credential leaked to an anonymous reader replayed against a privileged endpoint, an SSRF walked to usable cloud credentials, a reference followed into an object the crawl never reached. Correlated across the whole portfolio, these feed the proof-first ranking on the Attack Map and Attack Chains.

Last updated on