Skip to main content

AI Pentest (Nexus)

AI Pentest is the Plexicus dynamic testing product, powered by the Nexus engine: a swarm of AI agents that autonomously test a running web application, discover business-logic flaws and attack chains, and report confirmed findings with reproduction steps.

AI Pentest is a separate assessment that you create against a target URL. It is not a repository scan bundle: repository scans do not run dynamic tests.

Prerequisites​

  • A plan that includes AI Pentest (included from the Single plan; see Plans & Entitlements).
  • Pentest Units available. Each run uses units according to its depth; check Settings → Billing and Settings → Usage.
  • Proof of ownership of the target (see Domain Verification).
  • A running web application reachable at the target URL. A staging environment is recommended.

Create an assessment​

Select New Pentest from the pentest list (in Findings → App Pentest or under Assets). A four-step wizard opens.

Step 1: Target​

  • Assessment name — a descriptive name, for example "Prod login & checkout audit".
  • Target URL — the entry point the agents will test.

Step 2: Verify ownership​

Proof of ownership is required before any agent may test a target. Choose what to verify:

  • Verify this application — confirm ownership of the target host only. Use an HTML meta tag, an HTML file, or a DNS TXT record.
  • Verify the whole domain — verify *.<domain> once in Settings → Ownership Verification; every current and future subdomain then skips this step.

Step 3: Source repository (optional)​

Link one repository so confirmed runtime findings map back to code. This is what enables AI remediation (fix pull requests). Choose the branch and the code scope (full, diff or auto). You can skip this step; the pentest still runs and reports findings, but no fix pull requests are generated.

Step 4: Scan and launch​

  • Scan depth — Quick (minutes, for CI/CD and smoke checks), Standard (about 30 minutes to 1 hour, routine review) or Deep (1 to 4 hours, full audit with chained exploits).
  • Agents — how many agents the swarm runs. More agents cover more ground in parallel.
  • Focus areas — authentication, business logic, injection, access control, API security, payments, file upload, SSRF.
  • Out of scope — destructive actions, account deletion, email or SMS sending, payment capture, /admin endpoints, rate-limit flooding.
  • Known tech stack and additional context — write it like a brief to a human pentester: test accounts, critical flows, known issues to re-check, sensitive endpoints to avoid.
  • Login URL and authentication — provide how the agents should authenticate (username and password, bearer token, API keys or custom headers). Credentials are encrypted and never logged; use a test account.
  • AI credit cap — optionally limit the AI credits the run may use.

Review the summary, read the safety warning, and select Launch AI Pentest.

warning

A pentest generates a high volume of real requests. Prefer staging, and make sure you have approval to test the target.

Monitor a run​

The run page shows the status (Draft, Pending, Running, Completed, Failed or Cancelled), elapsed time, a live browser view when the engine opens one, the live war room board, the activity log, an attack graph and the session recording. You can cancel a running pentest with Cancel.

A run that fails, times out or is cancelled without a result returns its Pentest Units. A run that has been going for more than 90 minutes shows a "Scan may be stuck" notice so you can cancel it.

Findings and report​

When a run completes:

  • Findings list the vulnerability, severity, endpoint, method and reproduction steps, and appear in Findings → App Pentest and the main findings list (filter by pentest source).
  • Screenshots capture vulnerable flows.
  • The attack graph maps the paths the agents traced.
  • Download report saves the pentest report, which includes an executive summary, detailed findings and reproduction steps.

Use Rescan on a finished pentest to run it again against the same target.

AI Pentest generates HTTP traffic to your application. Only run it against applications you own or have explicit permission to test. Unauthorized testing violates law.

  • Use a staging or QA environment when possible, not production.
  • If you must test production, tell your infrastructure team to expect a high request volume.
  • Make sure your hosting provider's terms allow penetration testing.

Troubleshooting​

The pentest will not start​

  1. Ownership verified? Verify the application or its domain (Settings → Ownership Verification).
  2. Pentest Units available? Check Settings → Billing or Settings → Usage.
  3. Plan? AI Pentest must be part of your plan.
  4. Target reachable? Confirm the target URL responds to HTTP requests.

The login was rejected​

The run page shows the authentication result. If the login was rejected or unreachable, the scan is not launched; fix the credentials or login URL and rescan.

No findings were reported​

The agents may not have found vulnerabilities. Confirm in the activity log that they tested your target, and add authentication or context to help them explore deeper.

See also​