Agentic Pentesting, Explained: A Full Walkthrough of Reflectiz Offensive Hub

Most security teams run one of two things: a scanner that is fast but shallow, or a human pentest that is deep but rare and expensive. Neither gives you continuous, provable coverage of a real, login-gated web app.

Offensive Hub closes that gap. It runs agentic pentesting: autonomous AI agents that test your web applications the way a human attacker would, on the schedule and depth you choose. This walkthrough shows you how to build an agent, tune how hard it digs, read its findings, and understand what makes it work where code-writing tools fall short.

Watch the full product walkthrough

Prefer to see it live? This video walks through the same build, from creating an agent to reading its findings. The written steps below follow the same order.

How to use the Reflectiz pentesting agent

1. Create the agent

In Offensive Hub, click New agent at the top right of the screen.

2. Name it

Give the agent a name your team will recognize and add an optional description of what it should catch. Both appear in the live Summary panel on the right, which also tracks scope, mode, and intelligence level, and estimates the credit cost per assessment as you build.

3. Set the scope

Each agent tests one site. Select the single site you want this agent to run against. Scope locks once the agent has run, so to cover more sites, you create more agents.

4. Choose how it runs

Scroll down and set the run mode:

• On-demand: the agent fires only when you click Run now.
• Scheduled: the agent runs recurring assessments on the days and times you set. Scheduling gives you a start date and time, an optional end time, a repeat frequency (for example, the last Wednesday of every month), and an optional end date.

The Summary panel projects the credit cost both per assessment and per year at whatever cadence you choose.

5. Set custom rules

Custom rules save as properties of the agent, so you do not redefine them for every assessment. You can still tweak them for a one-off run.

• Custom user agent and request headers go out on every request the agent makes. Use them to flag your traffic or point the agent at a staging environment.
• Included and excluded paths narrow coverage. Leave the paths empty to test the whole site.

Whenever a rule fires during an assessment, it is recorded in that assessment’s activity log with a timestamp and outcome.

6. Pick the intelligence level

Intelligence is how hard the agent digs. There are four levels. Deeper levels run more capable and more expensive models, so you match each agent to the stakes of the target.

Whichever level you pick, a credit-consumption cap can pause an assessment once it hits a ceiling you set, keeping costs predictable.

The Agents dashboard

Once your agents are built, the Agents dashboard lists them all in one place, with a running tally of how many are active, on standby, or killed.

Each row shows the agent’s status, target, intelligence level, number of runs, coverage, credits used, findings, and when it last ran. Search or filter by scope, target, rule, or status to find the one you need.

Click any agent to open its activity log: the full history of its assessments, each with the credits it used and the findings it turned up.

Reading assessment results

Select a run to open its full results. Each run opens with a headline count: how many pages were tested, how many came back with findings, and how many were clean.

• On the left, every endpoint the agent visited is laid out in a grid.
• On the right, findings break down by severity (critical, high, medium, low), with a card for each one showing the category, the affected URL, and what the agent found.

A green checkmark means that endpoint was tested for that class of attack and came back clean. Search or filter by finding, category, or status to zero in on what matters.

Why agentic pentesting coverage matters

An agent never tires and never decides a check is too boring to bother with. It tests every endpoint it maps, for every check in its playbook, not just the interesting ones a human might gravitate toward.

For backlogged security teams, that means:

• Provable coverage. Every endpoint, every attack class, on record.
• A clear basis for triage. Findings ranked by severity, so you know what to fix first.
• Testing that scales to the stakes. Agents that are exactly as thorough as the target demands.

A human pentest is deep but rare. A scanner is constant but shallow. Offensive Hub is both: continuous and deep, on your schedule.

Under the hood: built like a human hacker, not a code generator

Most agentic security tools attack by writing code. They hand an LLM the ability to script attacks and lean on command-line crawlers. That suits problems that need bespoke tooling, but it is not how a person tests a website, and it struggles on the complex, login-gated web apps most businesses actually run.

Offensive Hub does what a real pentester does. It drives a genuine browser through a proxy, surfs the site the way a human would, watches the actual requests and responses, replays them, reads the JavaScript, and follows one action into the next. It logs in and clears one-time passcodes and two-factor prompts before any attack begins.

It can do this because it is built on the browser-based scanning engine Reflectiz has spent more than a decade refining, with an agentic attacker layered onto proven ground rather than reinvented from scratch.

That foundation is what lets Offensive Hub hold up on real, interactive sites where code-writing agents fall short.

See agentic pentesting on your own site

Offensive Hub gives backlogged teams provable coverage and a clear basis for deciding what to fix first, with agents that are exactly as thorough as you need them to be. For a deeper look at the model, read the CISO guide to agentic pentesting or compare agentic pentesting pricing models.