PROVE EXPERTISE · PenAgent™
Criminals are already using AI.
Your defence has to move at the same speed.
Days from disclosure to exploit
From 828 days to ≈ 10 hours
Once a vulnerability is public, defenders have only hours left. AI also speeds up your own development, and every change can open a new gap. That is why gaps must be found before attackers find them, ideally before release.
THE SOLUTION
Fighting AI with AI
PenAgent™ is Prove's own swarm of AI agents. It plans, runs and reports security testing every week, systematically.
Prove is approved for the security testing programmes of the language model providers we use, intended for verified security professionals.
It combines the speed of AI with the expertise of more than 400 Prove testing rounds.
BEYONDÂ SKANNERS
A scanner finds known gaps. PenAgent™ thinks like an attacker.
| Vulnerability scanner | PenAgent™ | |
|---|---|---|
| What it looks for | Known vulnerabilities and misconfigurations | Also gaps in application logic and access control |
| How | Compares against known signatures | Explores the application and chains findings into attack paths |
| Verification | Many false positives | Agents verify every finding and attach evidence and steps to reproduce it |
| Result | A list of possible issues | Reproducible findings with a CVSS severity rating |
A scanner belongs to the security baseline. PenAgent™ finds what a scanner cannot see, such as a forgotten endpoint that bypasses login.
REPORTING
Findings every week. A recap every quarter.
A list of findings, each with details, a CVSS severity rating, context and the steps to reproduce it. Your development team can start fixing right away.
A recap of the period's findings, a description of what was tested and how, and a summary for management.
The report documents testing and findings across the whole period, not just a single day.
When a customer asks when the system was last tested, the answer is "last week", with the report ready to attach.
Four reports a year show which way your security is heading.
RESULTS
Real vulnerabilities in client systems
- Critical12
- High193
- Medium564
- Low226
Most common finding categories: access control, session management and cross-site scripting.
Prioritised by CVSS severity. Critical findings are reported without waiting for the weekly report.
41 PenAgent™ runs against 13 targets.
A REAL FINDING
Admin access without credentials in two hours
- Situation
- The customer built a new login application on top of a legacy codebase. During the migration, an endpoint from the old system was left in the API.
- Finding
- PenAgent™ found this forgotten route in two hours.
- Impact
- Through the open route, anyone could create administrator credentials in the system.
- Cause
- The interface between the old and new systems had not been tested thoroughly.
Gaps like this are easy to miss in human-led work. Systematic testing reveals them, and so does an attacker using AI.
In October 2026, AI agents broke into the websites of more than 100 companies the same way: around a protected application, through a publicly exposed control panel. Reuters
SUMMARY
Point-in-time vs. continuous
| Annual pentest | PenAgent™ | |
|---|---|---|
| Cadence | Once a year | Weekly |
| Visibility | A single moment | Always up to date |
| Risks from changes | Seen at the next test | Seen within a week |
| Ahead of attackers | Rarely | Every week |
| Audit evidence | One report a year | A report every 3 months |
GETTING STARTED
Three things from you. We handle the rest.
- A test environment
- User credentials
- Permission to start
+ VAT
- Includes weekly reports and a quarterly recap
- 12 months at a time, renewal agreed separately
- 2-month scoping period: either party can end it at once
Attackers won't wait for your next annual test. Neither do you.
This presentation describes the service as of November 2026. PenAgent™ is under continuous development, and this content is updated as the service evolves.
A Finnish software and security testing company based in Oulu since 2006.
FAQ
This is PenAgent™ in practice
What is our data used for?
Only for your testing. PenAgent™ uses commercial language model services, listed in our sub-processor list. Anything PenAgent™ sees in your test environment may be passed to these services. That is why the test environment must not contain production data or real personal data. The providers generally retain data for up to 30 days for abuse monitoring, and it is not used for model training.
Prove is approved for the security testing programmes of the language model providers we use, intended for verified security professionals.
Where is our data processed?
We use the most capable language models approved for security testing, because they are the best at finding vulnerabilities. They may also process data outside the EU, in which case transfers are based on EU-approved transfer mechanisms.
Processing cannot be limited to the EU.
How are our credentials and findings protected?
Only Prove's security testers operate the agents, and unremediated vulnerabilities are handled as highly confidential. Credentials are available only to the testers and are deleted when the contract ends or when you change them. We recommend using separate test credentials.
What does PenAgent™ test?
PenAgent™ tests the agreed target in your test environment. We do not access your production systems, internal systems or source code.
We limit the target, not the technique: inside the test environment, the agents move like an attacker would. That is why the environment must be separated from production. If any resource is shared, you tell us in the kick-off form, and we go through it with you.
If testing moves through the target into other systems, that is a finding. If testing were to reach anything other than a confirmed target, we stop it, notify you and take responsibility under the contract.
How is the testing scope agreed?
You confirm the target and the exclusions, and we help you define them. We draw on the experience of more than 400 testing rounds: we know what attackers typically target. The target is refined during the scoping period.
How mature is the service?
PenAgent™ is a production-ready service used in client engagements, and we develop it continuously to keep pace with evolving attack methods.
How does PenAgent™ compare with expert-led pentesting?
We compared PenAgent™ with Prove's expert-led pentesting in five client projects in late summer 2026. Both tested the same target with the same prior information.
PenAgent™ found 91% of the experts' findings. The ones it missed were context-dependent low and medium severity vulnerabilities. In addition, PenAgent™ found 6 vulnerabilities that the experts did not detect, one of them critical. In the comparison, an expert verified all of PenAgent's findings.
What do the reports contain?
Every week you receive a list of findings. For fixing the issues, each finding includes details, a CVSS severity rating, context and the steps needed to reproduce it.
Every quarter you receive a recap: a summary of the period's findings, a description of what was tested and how, and a summary for management and other stakeholders.
Does a person review the findings?
Yes, at report level. A validation agent verifies every finding and records the evidence needed to reproduce it, so you can check any finding yourselves. The Prove security tester operating the service reads every report before it is sent to you. You can ask Prove's experts about the findings.
What does the price include?
The price covers testing of one target, meaning one application. Its web interfaces and APIs may sit at several addresses. If you need PenAgent™ for several applications, we will be happy to prepare an offer tailored to you.
Which contract terms apply?
The contract consists of the order agreement, the general terms, the personal data processing terms, the testing authorisation, the sub-processor list, the service description and the information security practices. You sign only the order agreement, which brings the other documents into the contract. Liability is set by the general terms.
By signing the contract, you confirm that you are authorised to permit testing of the target environment. This also applies to environments hosted by third-party services.
If we change the contract documents unilaterally, you can object to the change and, if needed, terminate the contract.
Prove holds professional liability insurance.
Prove Expertise Oy
Kirkkokatu 8A3, 90100 Oulu, Finland
Testing is mental health work – everyone from developer to end user is happier when the software works
This is usually where you'd find a flattering, official company introduction. But we both know nobody actually wants to read that kind of fluff, so let's get straight to the point!
- Software testing and cybersecurity since 2006
- 35 professionals working at Prove in Oulu and Helsinki
- Our 200+ customer reviews average 4.86/5
- We always work with a 110% satisfaction guarantee! Because working together only makes sense if both sides benefit.
- And if for any reason it feels like it's not working out, you can drop us with one hour's notice.
Phew. Now that that's out of the way, go and see what Prove can actually do for you!
