As applications grow and change, the demand for expert-depth security testing grows with them. Your team has to choose where to apply its expertise: which applications need closer investigation, which leads to pursue, and what to revisit between pentests.
Today, we’re bringing Burp AT to our enterprise platform, helping your team bring deeper testing to more applications through scheduled autonomous tests, within boundaries you control.
Burp AT for enterprises See how Burp AT brings deeper testing to more applicationsPentesters have shown what agentic testing can do on a single application with Burp AT. The question for security teams is how to bring that to a whole application estate without losing control.
Burp AT now lets teams run agentic tests autonomously at scale, with the scope and safeguards set in advance, while ensuring that teams can stop, steer and see what the agents are doing.
Teams get that depth across more of their applications, with control built in.
We introduced Burp AT alongside Burp Suite Professional in July 2026. Now you can put the same foundation of Burp’s specialist web security tools and research-led testing skills to work across your enterprise testing program. Your team controls scope, reviews findings and decides what to do next.
Burp’s tools and research-led skills
Burp AT helps teams bring specialist testing depth to more applications, equipping agents with the Burp tools professional pentesters use and purpose-built skills developed with PortSwigger Research.
Burp’s specialist tools handle the malformed requests and unusual traffic that security testing involves. Autonomous tests follow a defined methodology, adapting their approach as they learn. Skills developed with PortSwigger Research bring specialist web security techniques to each test.
The best results from agentic testing come from giving agents the right tools, not just a capable model.
Burp AT lets agents use Burp’s specialist tools autonomously, guided by workflows our researchers have tested in practice. In Burp AT, we tie those tools together into a complete test that helps agents remain consistent across tests by following defined pentesting methodologies.
The agent brings the reasoning, and Burp brings the precision, which is how autonomous testing delivers the depth teams need.
Your team chooses the autonomy, and Burp’s boundaries still hold
You choose how much testing to automate and where teams stay closely involved, from user-guided to autonomous execution of defined tests. Your teams can adjust the authority they delegate according to the application or task, while retaining the ability to step in and stop the test when needed.
Whatever level of autonomy you choose, Burp enforces configured scope and permissions, not the model itself, meaning agents cannot execute actions the tooling layer does not permit — such as executing code — therefore, maintaining testing boundaries as more execution is delegated. Teams retain visibility into test activity and the evidence behind findings, giving them the oversight to assess results and make decisions about risk.
Burp AT for your own workflow, or across your estate
With Burp Suite Professional
For practitioners augmenting their own workflow, Burp AT runs alongside Burp Suite Professional: a tester partners with agents on the pentest they’re running.
Explore Burp ATAt enterprise scale
For enterprises, Burp AT runs autonomous testing at scale. More of your applications are investigated in depth, with authority your organization controls and evidence your experts can assess.
Explore Burp AT for enterprises