how it works
from your repo to a proven exploit — one pipeline.
Specialized AI agents run a seven-phase pipeline — static analysis, reconnaissance, vulnerability analysis, exploitation, and chain analysis — and hand back deterministic proof-of-exploit with a one-line fix. Not a pile of alerts. Not a severity score. It runs in your environment — your code never leaves.
sixteen specialized agents. fifty-plus tools. every scan runs the same deterministic sequence — from recon through to proof-of-exploit.
click to explore each phase ↓seven phases. read each one.
White-Box + SAST
Seven SAST engines plus a whitebox LLM reviewer read the repo, emit hypotheses, and seed every later phase with ground truth.
- agentwhitebox-reviewer— reads diffs + whole-repo context, emits ranked hypotheses with file:line anchors
- toolsemgrep— taint + pattern rules (p/owasp-top-10, p/python, p/javascript)
- tooltrivy— dependency + container + IaC scanning
- toolbandit— python AST · weak crypto, subprocess, yaml.load
- toolgosec— go AST · hardcoded creds, unsafe exec, TLS config
- toolcheckov— terraform / cloudformation / k8s manifests
- toolnjsscan— node.js + express insecurity patterns
- toolgitleaks— commit-history secret scan (depth=500)
1Finding {2 id: "F-01",3 kind: Vuln::SqlInjection,4 verdict: Verdict::Hypothetical,5 source: Source::Whitebox,6 anchor: "payments/query.py:142",7 evidence: "semgrep ▸ tainted-sql-format",8 cvss_est: 7.5,9}
most scanners report individual vulnerabilities. sekura maps how they chain together — because a breach is never just one thing.
click through the states below ↓the chain is the finding.
sast and dast stop at the hypotheses. sekura keeps walking — and turns a handful of medium findings into the thing that actually keeps a ciso up at night.
integrations + compliance
Works where you already work. Maps to what you already report.
Works with
IDEs (via MCP)
- Claude Code
- Cursor
- VS Code
- Windsurf
CI/CD
- GitHub Actions
- Self-hosted runners
LLM providers
- Anthropic Claude
- OpenAI GPT
- Private endpoints (Enterprise)
Notifications + fixes
- Slack
- Outlook
- Teams
- Jira
- Confluence
Maps to
Findings auto-mapped to 14 compliance frameworks.Audit prep as a byproduct of every scan.
- SOC 2
- ISO 27001
- HIPAA
- PCI DSS
- NIST CSF
- NIST 800-53
- GDPR
- CCPA
- FedRAMP
- HITRUST
- FFIEC
- CIS
- GLBA
- CMMC
comparison
Without Sekura · With Sekura
What changes when you replace the scan-and-triage loop with continuous, proof-first autonomous pentesting.
| Without Sekura | With Sekura | |
|---|---|---|
| Output | Ranked list of potential issues; CVSS scores divorced from your environment | List of exploited issues, each with a deterministic proof-of-exploit |
| False positives | Inherent — scanners flag what might be vulnerable, your team validates each | Eliminated by construction — Sekura only reports findings it has actually exploited |
| Scope | SAST or DAST or SCA — one surface per tool, one tool per vendor | SAST + DAST + exploit chaining + LLM-security + post-quantum crypto in one scan |
| Cadence | On-demand or scheduled — weekly at best, annually for manual pentests | Continuous — every push, every PR, optionally every hour |
| Triage burden | Hours per finding to validate, prioritize, and fix | Zero — every finding ships with the payload that demonstrates it |
Frequently asked questions
What is autonomous penetration testing?
Autonomous penetration testing uses specialized AI agents to find and exploit vulnerabilities in a target system without a human pentester driving each step. Sekura runs a 7-phase pipeline — white-box SAST, recon, post-quantum crypto review, dynamic probing, exploit synthesis, chain analysis, and reporting — and verifies each finding by actually exploiting it.
How is Sekura different from traditional vulnerability scanners?
Vulnerability scanners output a list of potential issues ranked by severity score. Sekura verifies each finding through actual exploitation and only reports what it can prove. If a vulnerability cannot be exploited in the target environment, Sekura does not report it. The result is a short, ranked list of real, exploitable issues instead of thousands of theoretical alerts.
Does Sekura produce false positives?
No. Every reported finding includes a deterministic proof-of-exploit — the exact request, payload, and response that demonstrates the vulnerability is real. If Sekura cannot produce a proof, the finding is not reported.
How is autonomous pentesting different from a manual pentest?
A manual pentest is a point-in-time engagement that takes weeks and costs $30,000 to $150,000 per cycle. Sekura runs continuously, covers the whole attack surface, and updates as your environment changes. Both produce proofs-of-exploit; only Sekura runs every hour.
What LLM models does Sekura support?
Sekura works with Anthropic Claude and OpenAI GPT models. LLM calls are routed through proxy.sekura.ai so customers see exact token counts and pay one metered cost. Self-hosted Enterprise deployments can use private model endpoints.
Does Sekura see my source code?
No. The scanner runs entirely inside your GitHub Actions runner (cloud distribution) or behind your firewall (enterprise distribution). Sekura sees prompts and responses to the LLM proxy but never your repository contents. Findings are uploaded; source code is not.
Is Sekura open source?
The scanner CLI and agent runtime are source-available. The orchestration platform, dashboard, and managed cloud are commercial. See github.com/sekuraai for the public components.
What does Sekura test that other tools miss?
Sekura combines application security testing (SAST + DAST + exploit chaining) with LLM-security testing (prompt injection, jailbreak, data exfiltration) and post-quantum cryptography review (crypto-agility audits flagging quantum-vulnerable algorithms) in a single scan. Most tools cover one of these surfaces; Sekura covers all three.