Agent Breach

Agent Breach is a platform for continuous security testing of authorized web applications and APIs. It records evidence for each finding and keeps confirmation states explicit instead of inferring them from status codes or redirects. How it works: - The user adds a target URL (staging or production) and can optionally add OAuth, SAML, API key, or session cookie authentication. - An LLM-based planner selects and sequences tools from a catalog of 45+ security tools and techniques (including Nuclei, SQLMap, and Nikto) via MCP, based on each response. - Discoveries are validated against recorded responses and control comparisons, and original tool output is retained. - Findings include the affected URL, method, parameter, recorded request, observed result, reproduction steps, caveats, and remediation. Retests verify fixes. Reporting: - PDF templates: AI Explained, Executive, Developer, OWASP WSTG/ASVS, NIST 800-115 & CSF 2.0, CREST, PCI-DSS ASV-style, CIS Controls - Framework mapping JSON for SOC 2, PCI-DSS, HIPAA, ISO 27001, MITRE ATT&CK, CIS Controls, NIST CSF 2.0, and OWASP ASVS - Evidence Pack ZIP, retest appendix, and PDF, JSON, and CSV exports - Signed proof and a public verifier for AI Explained and compliance PDFs Pull request scanning: A GitHub App runs hosted PR scans using Semgrep, Gitleaks, Trivy, OSV Scanner, OpenSSF Scorecard, workflow hardening checks, and dependency manifest delta. It posts check runs and inline comments with a pass/warn/fail policy. Code security audits are priced separately. Access and pricing: A live simulation based on OWASP Juice Shop is available. New company domains get a trial of up to 14 days for one authorized target and one scan. Paid options include Team, Growth, and Enterprise plans, or payment per completed web scan.