Introducing Apex
An agentic penetration tester for web applications.
Apex is Sprocket's first AI agent: a context-aware penetration tester for web applications. It performs unauthenticated testing the way a Sprocket tester would, working through reconnaissance, discovery, exploitation, and reporting. Suspected findings are validated as needed, then handed to our testing team to review and publish.
Apex is an extension of our testing team, not a replacement for it.
Agentic Penetration Testing
How Apex Works
- Reasoning. Apex maps your application, forms a theory about where it might break, and tests that theory. It reasons through the app like a human tester would, instead of running a scan.
- Context-aware. Apex knows your web assets and your past findings. It uses them to skip issues you have already seen or are currently open, catch fixed bugs that have resurfaced, and judge severity against your actual environment.
- Validated. Apex re-tests every suspected issue on its own before recording it. If it cannot prove the impact, it does not report it, ensuring you always get quality findings.
- Human-owned. A member of the testing team reviews and publishes Apex findings before they reach you.
What you get
Attack Narratives
An Attack Narrative is written for every run covering what was tested, whether or not it produced a finding.
Findings
Findings delivered in the platform and through the API, exactly like every other finding. No new dashboards, no new process.
Each finding includes a severity, a clear description, a real proof of concept, remediation guidance, and references.
Built for trust
Hosting
Apex runs entirely inside Sprocket's AWS environment using leading frontier models, in trusted data centers that don't train on assessment data.
Non-destructive
Apex tests in a measured way, ensuring it is controlled and non-destructive for production environments. Anything it writes is its own test data, which can be reversed and cleaned up at the end of testing.
Kill switch
One familiar kill switch: the existing Stop Testing control halts Apex too, so you keep immediate control, exactly as you do today.
Who will see Apex
Every customer
The Sprocket Testing team puts Apex to work during the continuous external penetration testing you already receive.
Always on for web app testing customers
If you have Sprocket web application testing, Apex runs unauthenticated testing on its own recurring schedule across every web app in your scope, so the exposure time between human assessments shrinks.
Questions?
Not sure what type of testing is included in your partnership? Your Sprocket Account Manager can tell you where Apex runs for you, and how to add scheduled web application testing.
Further Reading
Explore Latest Content.
How Combined AI and Manual Testing Discovered Two Zero Days
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days. read more →
Read more