Meet the fleet
AI + HUMANS
Our AI agents run reconnaissance, discovery, and exploitation — then hand off to expert human testers who verify impact and drive findings to closure. Every agent has a specialty, a boundary it cannot cross, and a human who answers for its output.
How Sprocket's AI + Humans is different:
- A published safety framework — seven properties, four phases, mapped to OWASP APTS
- Enterprise transparency as architecture: a glass box, not a black one
- A human operator supervises AI workloads start to finish
- Our own testers who stay on your account — operator and institutional memory
- A validation chain that eliminates your triage burden
- Zero-data-retention: your data is never used for training
- ASM-driven discovery
- Ten years of curated offensive data behind our tooling and frontier models
- Time to value: 1–2 weeks to first validated findings
What Sprocket's AI + Humans is not:
- Not a scanner pretending to be a pentest.
- Not a marketplace of strangers.
- Not autonomous AI with no one at the wheel.
- Not unvalidated AI findings that your team has to triage.
- Not simply a wrapper around frontier models.
Sprocket supervises every finding, curates every tool, and operates with transparent safety constraints.
Every boundary above is defined in a framework you can read.
Seven required properties — Bounded, Proportionate, Veridical, Contained, Efficient, Transparent, and Governable — each with rationale, core mechanisms, and a named failure mode, mapped across four engagement phases and crosswalked to the OWASP Autonomous Penetration Testing Standard. Versioned, published in full, and no form to fill out.
| Property | Maps onto (APTS domain and representative requirements) | Nature of fit |
|---|---|---|
| Bounded | Scope Enforcement (SE): machine-parseable rules of engagement, pre-action scope checks, immutable deny-lists (APTS-SE-001, SE-006, SE-009). Scope-changing injection sits in Manipulation Resistance (APTS-MR-005, MR-012, MR-023). | Direct on core scope. APTS splits this across two domains and files rate-limiting and production-impact control under SE, which this framework treats under Proportionate. |
| Proportionate | Safety Controls and Impact Management (SC): CIA impact classification, per-tier payload and rate caps, graduated approval escalation, health-based automatic halt (APTS-SC-001, SC-004, SC-006, SC-010); adaptive backoff (APTS-SE-019). | Substantial overlap, one addition. APTS already constrains per-action impact through CIA classification, per-tier payload and rate caps, and graduated approval escalation. This framework adds minimizing impact within that permitted envelope — proving a finding with the least sufficient action and stopping at proof rather than maximizing exploitation. |
| Veridical | Reporting (RP): evidence-backed findings, automated reproduction, confidence scoring, false-positive-rate disclosure (APTS-RP-001, RP-002, RP-003, RP-006). | Direct and enriched. APTS mandates the mechanics; this framework adds the argument that a false positive is a trust violation, not a mere defect, and separates the discovering role from the reporting role. |
| Contained | Third-Party and Supply Chain Trust (TP): per-engagement isolation, cross-engagement leak detection, no reuse of one customer's data for another (APTS-TP-017, TP-018, TP-019, TP-020); execution sandbox (APTS-SC-019). | Split, with a gap. APTS's "third party" is the platform's own supply chain. Custody of outsiders' data that the agent discovers as a byproduct — the discoverer model — has no APTS home and is developed separately here. |
| Efficient | Safety Controls (SC) hard stops and time-based termination (APTS-SC-011, SC-013); Graduated Autonomy (AL) resource management. | Largely this framework's lens. APTS has these as scattered controls; treating efficiency — budget ceilings and value-rate decay — as a safety backstop of last resort is not an APTS property. |
| Transparent | Auditability and Reproducibility (AR): structured event logging, an audit trail the agent cannot reach, post-update regression of safety controls (APTS-AR-001, AR-020, AR-017). | Direct. This framework adds the framing that recording is structural and involuntary, occurring at a layer the agent cannot disable. |
| Governable | Human Oversight and Intervention (HO): approval gates, decision-timeout SLAs, one-click kill switch, low-confidence escalation (APTS-HO-001, HO-003, HO-008, HO-013); kill-switch timing bound (APTS-SC-009). | Direct. This framework adds the argument that governability is what keeps the other six properties enforceable as unanticipated situations arise. |
Questions about our AI agent fleet
Are the AI agents autonomous, or do humans stay in the loop?
Both. Agents run reconnaissance, discovery, and exploitation, but every finding that matters is verified by an expert human tester before it reaches you. AI finds the path; humans confirm the impact.
How do you keep the agents from causing damage during testing?
Every agent operates inside a defined safety framework with hard guardrails on scope, rate, and destructive actions. Exploitation is validated in a controlled way, and anything high-risk is gated behind human approval.
What is the difference between an AI agent and a human tester here?
Agents give you breadth and speed around the clock. Human testers bring judgment — chaining findings, reasoning about business logic, and separating real risk from noise. You get both on every engagement.
Will more agents be added over time?
Yes. The fleet is actively expanding — the tiles marked "Recruiting" are agents in development. Each new agent ships with a defined specialty and a human owner.
Can I see the agents in action before I buy?
Absolutely. Reach out for a live demo and we'll walk you through how the agents and human testers work together on a real attack surface.
Further Reading
Explore Latest Content.
How Combined AI and Manual Testing Discovered Two Zero Days
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days. read more →
Read more