From capable AI models to trusted security testing | Blog

This week, we launched Burp AT in public beta for Burp Suite Professional users. Next week at Black Hat, PortSwigger Research will reveal more of the work that helped shape our direction.

Burp AT is our product response to what that research is showing us. AI will take on more of the work of a pentest, which makes the tools, expertise, and controls around it increasingly important.

AI can already find and exploit vulnerabilities. PortSwigger Research has been exploring whether an agentic system can go further by absorbing an expert research methodology, generating and testing hypotheses, interpreting evidence, and producing genuinely novel findings.

That research feeds directly into the techniques, tools, and skills in Burp AT. The product challenge is to make agentic capability useful for real-world security testing, where you need control over what happens, evidence of what happened, and results you can stand behind.

Control must sit outside the model

Models are useful in offensive security because they are creative, persistent, and willing to pursue unexpected paths. Those same qualities also mean they cannot be trusted to police themselves.

They can ignore an instruction, misunderstand the target, or describe their own actions inaccurately. That unpredictability can help when forming hypotheses, but it cannot enforce scope or produce an authoritative audit trail.

Prompting agents to stay in scope is not scope enforcement. Asking one model to supervise another does not change the structural problem, because both rely on the same probabilistic technology.

Control therefore has to sit outside the model. In Burp AT, agents can decide what they want to try, but permissions and scope boundaries are enforced by Burp. Burp blocks disallowed actions and, where your settings require it, pauses for your approval. Requests and tool activity are recorded in the project alongside your own work, so you can inspect what actually happened.

The more capable agents become, the more important this separation is. Agents that can pursue longer chains of work with less supervision can create more value, but they can also make more consequential mistakes. This does not mean stopping agents at every step. Routine work can proceed within the boundaries you have set, while decisions involving risk, ambiguity, or judgment come back to you.

Daf explored this distinction in The beast needs a cage.

Tools become more valuable when agents can use them

Because models can write code and construct HTTP requests, it is tempting to assume that security tools will matter less. In practice, we have found the opposite.

Agents can hand-craft requests, write scripts, and process responses. But rebuilding the mechanics of security testing from scratch is expensive, inconsistent, and fragile. Authentication state, browser behavior, malformed traffic, protocol quirks, response comparison, session handling, and application-specific logic all create edge cases that mature tools already know how to handle.

The model can spend its context on hypotheses, decisions, and interpretation instead of reproducing plumbing that already exists. Testing becomes more repeatable, and the requests and responses remain visible in the same project you are using.

An agent improvising every operation will struggle to match one working through a mature, specialized toolkit. Burp Suite’s tools have been developed over more than 20 years and tested at scale against real applications, protocols, and technology stacks. Giving agents access to that tooling makes it more valuable, not less.

Turning research expertise into reusable skills

Frontier models are broad generalists. They can reason across many domains, but they do not arrive with the methods of the best security researchers.

PortSwigger Research has always shaped what Burp can do. New vulnerability classes become testing techniques, scan checks, and deeper support for the protocols and behaviors you encounter. Agentic systems create another route for that expertise to reach the product.

James Kettle’s recent work demonstrates the approach. Over the past year, he has turned parts of his research process into a system that can generate and test hypotheses, interpret results, and pursue the most promising lines of investigation. At Black Hat, he will share the research and the blueprint behind it.

That work feeds into Burp AT in several ways: new techniques can become reusable skills, new requirements can shape the tools agents invoke, and edge cases can improve how the product behaves and how it is evaluated.

In Burp AT, that means purpose-built skills developed with PortSwigger Research. Agents can follow structured, task-specific approaches rather than inventing a workflow from general model knowledge. As those approaches are developed and refined, they can be translated into reusable skills for security testing.

This gives new research a faster route into real security tests, without you having to reconstruct the method yourself.

Where your judgment matters

Today, you decide how much work agents take on and where your judgment matters.

You know what strong and weak testing looks like. You can recognize when agents have made meaningful progress, misunderstood the target, or produced a conclusion that only looks convincing. You decide which objectives matter, how business context changes the meaning of a finding, which actions are appropriate, and which conclusions you are prepared to stand behind.

That does not mean approving every request. Your level of involvement should depend on the task. On a sensitive production workflow, you may stay close to every consequential action. In a lower-risk area, routine work can continue under standing permissions. The right level of autonomy depends on the task, target, risk, and how much trust the system has earned.

You can give agents a goal or line of investigation, let them work through Burp’s tools, and take over directly in Burp whenever you choose.

Web security testing is unlikely to move neatly from manual to autonomous. It will shift between modes. Deep expert-led testing will remain valuable. Automated scanning will continue to provide breadth and repeatability. Agentic systems will increasingly connect the two, taking on more work within enforced policy while surfacing the decisions that need human judgment.

Over time, the same foundation can extend to teams and enterprises: centrally defined scope and policy, shared approval rules, role-based controls, organization-wide visibility, deployment and data-handling options, and integration with wider security and remediation workflows.

Built for models that keep improving

Burp AT is built on the assumption that models will keep improving. The tools, context, skills, and governance around them therefore need to remain valuable when today’s capability gaps disappear.

As agents become more capable, they need reliable ways to act, boundaries they cannot override, and evidence that you and your organization can inspect. They also need access to expertise that goes beyond general model knowledge.

Burp AT puts those pieces to work today, with you deciding how much of the work it takes on. At Black Hat next week, PortSwigger Research will show more of the capability and methodology that helped shape Burp AT.

Read the Burp AT launch post to see what is available in the public beta.