Scale in-depth testing.
Get deeper testing across more of your applications without requiring an expert to direct every step. Burp AT adapts to each application as it follows a defined methodology within the boundaries you’ve set.
Burp AT · For enterprises Talk to us Burp AT · For enterprises
Deeper testing. More applications.
Scale agentic pentesting across your portfolio with autonomous tests, powered by Burp’s tools and skills developed with PortSwigger Research.
Burp Suite is trusted by the world’s most security-conscious organizations
SAP Microsoft amazon NASA salesforce FedEx ORACLE
90,000+pentesters and security teams use Burp Suite
1,000+organizations automate testing with Burp Suite DAST
20+ yearsof specialist web security tooling
Why now
Every testing program has a waiting list.
As applications grow and change, your AppSec team needs a way to bring expert testing depth to more of them.
The same Burp AT that supports hands-on pentesting extends that capability across your organization. Scheduled autonomous tests put Burp’s tools and research-led skills to work across your applications, while your team sets priorities, controls access and acts on the findings.
Read more: Introducing Burp AT at enterprise scale →On the desktop
With Burp Suite Professional
Pentesters direct agents that plan and carry out in-depth investigations, using Burp’s tools and project context throughout a live engagement.
Burp AT for hands-on testing →In the enterprise platform
At enterprise scale
AppSec teams extend that depth across their applications through scheduled autonomous tests, with control over access and boundaries enforced by Burp.
How agentic pentesting scales across your portfolio.
Burp AT’s agents plan tests, use Burp’s specialist tools and adapt to each application’s responses. Tests run across configured applications, within boundaries enforced by Burp.
-
Set up applications
Configure scope and authentication for the applications you want to test, then set autonomous testing schedules that reflect your program’s priorities.
-
Run agentic tests
Agents use Burp’s tools and skills developed with PortSwigger Research to test each application, adapting their approach as they learn within its configured boundaries.
-
Act on the findings
Get findings supported by verification evidence and clear explanations of impact, so your team can address weaknesses and focus expert attention where it matters most.
Use scheduled tests to support release reviews, revisit critical applications between pentests and bring deeper testing to more applications.
Built for the way web security testing works.
Agentic testing depends on more than model reasoning. Burp’s specialist tools, research-led skills and enforced boundaries provide a foundation built for professional web security testing.
The Burp tools you trust
Specialist tools for web security testing.
Agents work through the specialist tools pentesters rely on, refined over decades of web security testing. Burp handles session state, malformed requests and unusual traffic while the agent decides what to test next.
20,000+organizations use Burp Suite for web security testing
Purpose-built pentesting skills
Skills developed with PortSwigger Research.
Autonomous tests work through a defined methodology, adapting their approach as they go. Skills developed with PortSwigger Research bring specialist web security techniques to each test.
Manage agentic testing across your portfolio.
On our enterprise platform, configured applications, schedules and site permissions stay organized in one place, with issue evidence and recorded changes available to support your AppSec team’s reviews.
- Use your existing application setup Burp AT uses each application’s configured logins, scope and scan configuration for scheduled tests, so your team does not need to repeat the setup.
- Choose who can test You decide who can use Burp AT for each application through a dedicated site permission, which controls who can see and run agentic tests.
- Schedule the testing you need Schedule recurring autonomous tests for your applications, then adjust the cadence as your testing priorities change.
- Manage tests and review findings Site and folder views let your AppSec team manage scheduled and completed tests across configured applications. Review issue evidence and recorded changes to prioritize follow-up, or stop tests when your program’s needs change.
If your organization already uses Burp Suite DAST for repeatable scanning, add Burp AT’s adaptive testing depth where your applications need closer assessment.
Bring deeper testing to more applications.Discuss how autonomous tests could fit your program and the cadence you need.
Talk to usScale testing within boundaries you set.
Both modes use agents that plan, work through Burp’s tools and adapt; you choose how much autonomy to give them within your testing boundaries.
Keep closer control.
Use guided mode when a specific finding or part of an application needs closer attention, with your team directing the work within Burp’s enforced boundaries.
See how findings are checked and supported.
Findings are investigated and supported with evidence, so your team can see what was tested and how the conclusion was reached. Review the explanation, business impact and recorded issue changes to act on confirmed weaknesses and identify where further testing would help.
Illustrative finding
!
Checkout and promo codes · ginandjuice.shop · POST /checkout/apply-coupon Coupon limit can be exceeded via a race condition
Verified riskExample business impact
A single-use promo code can be applied more than once, reducing the order total each time.
What your team can review
- The issue explanation
- Business impact
- Evidence gathered during verification
- Recorded issue updates
Burp enforces the testing limits you set.
Burp’s tools block agent actions outside your configured testing limits, so enforcement does not depend on the model following an instruction.
How a test runs
How Burp enforces your testing limits
- To investigate the application, the agent plans its approach and requests actions from Burp’s tools.
- Burp’s tools enforce site scope, scan configuration and mode-specific tool restrictions, blocking any requested action that falls outside those limits.
- If an issue is raised, your team can review its explanation, supporting evidence and recorded changes to see how it developed.
- Fixed scope. The agent cannot change the site’s scope or scan configuration during a test.
- Tool restrictions. Autonomous tests cannot execute arbitrary custom scripts or use other tools considered dangerous.
- Site permissions. You choose who can see and use agentic testing for each application.
- Stopping tests. You can stop one test or several at once, then review them without restarting.
Does your security or legal team need more information?
Discuss your adoption requirements →What does your organization need to know?
Hosted testing
Run Burp AT on our hosted enterprise platform.
Test isolation
Your tests run in an isolated environment, separate from other organizations’ testing.
Application setup
Set each application’s scope and logins before scheduling tests.
Data handling
Discuss your requirements for model processing, data retention and contracts.
Program fit
We can talk through how Burp AT would fit alongside your existing testing.
How testers are using Burp AT.
From a pentester using Burp AT with Burp Suite Professional during an engagement.
A critical flaw uncovered in 66,000 lines of JavaScript.
After Burp AT investigated a reporting workflow, the tester directed an Intruder attack that confirmed access to confidential reports.
Read the full story →Scale agentic pentesting across your program.
Talk to us about your application portfolio, how often you need deeper testing and your organization’s requirements.