Security integrations: a finding in a dashboard is a finding waiting

GitHub Actions, GitLab CI and Jenkins, with scans on pull requests and merges and a severity threshold you set to fail a build, made practical by Quick Scans at 15–30 minutes.

SARIF export places them in the IDE and the pull request, on the line in the diff, with the remediation example attached. The same SARIF file can be imported into your existing code scanning view, so findings sit beside the rest of your code alerts.

Yes — Jira receives findings as tickets with severity mapping, and Linear synchronises findings with CVSS-based priority assignment.

Yes, through webhooks for scan events and a REST API with full access to scans, findings and reports, which is how several teams build their own view instead of using the dashboard.

Not yet. Docker container image scanning is on the roadmap and not yet available.

Not yet. AWS EC2, S3, Lambda and IAM assessment and Azure VM, storage and directory scanning are on the roadmap. Internet-facing cloud-hosted assets are already discoverable and testable as network and application targets.

Yes — automated delivery via email or Slack, plus time-limited shareable links with access controls for recipients outside the workspace.

Yes, installable via pip, npm or Homebrew, authenticated with aiptx auth login or AIPTX_API_KEY, then aiptx scan, aiptx findings list and aiptx report generate.

For recurring, breadth-first security testing — yes, and much more frequently than any human-led cadence allows. But for a highly customized engagement involving novel business logic, physical or social engineering testing, or a regulatory requirement for a certified human tester, expert pentesters have a critical role to play. Most teams use AIPTx for ongoing automated penetration testing with specialist assessments once per year.

No. Destructive actions are disabled by default — the agent will not delete data, run denial-of-service attacks, or consume excessive system resources. All test activities are rate-limited per the rules defined in your organization. Exploitation is only used to demonstrate access (such as reading a single record) and never to cause damage.

Through exploitation-based validation. A finding is only marked “confirmed” if the attack was successful and the evidence (request, response, and resulting server state) has been collected. Any finding that only used version fingerprinting or heuristic analysis is marked “unproven” and is put in a separate category for triage, lowering false positives by orders of magnitude compared to traditional vulnerability scanners.

Yes. Every penetration testing run produces an executive summary, detailed technical report with evidentiary support, remediation plan, and retest attestation, with findings mapped to applicable compliance regimes. We produce the same audit-quality documentation as a traditional cybersecurity consultancy, but with the added benefit of showing exactly when a given issue was fixed.

A test starts as soon as the target is configured, and the first proven findings usually appear within an hour. A Quick Scan for a pull-request gate completes in 15–30 minutes, a release-candidate scan takes a few hours, and a deep scan of a large application with extensive authentication rarely runs past overnight, against roughly six weeks for a traditional consultancy engagement.