Leanpub Header

Skip to main content
Go to Leanpub.com

Agentic Pentesting: Design and Deploy AI Pentest Agents

How to build, size and secure AI agents for real-world engagements

autopen

AI pentest agents already find real vulnerabilities on real networks, sometimes faster than experienced pentesters. They are improving fast, and running them safely on a real engagement will soon be as basic a skill as using Burp. This course shows you how to choose an architecture and a model, size the hardware, keep the agent in scope and validate what it finds. Learning it now puts you ahead of the pentesters who will have to catch up later.

Minimum price

$79.00

$99.00

You pay

Author earns

$

Also available for 1 course credit with a Learner Membership

PDF
EPUB
WEB
About

About

About the Course

Most AI security courses teach how to attack AI systems. This one teaches how to build an AI agent that performs penetration tests, and how to run it safely on real systems, for a client or for your own organization.

You will learn to handle a request for agentic pentesting from start to finish, whether it comes from a client or from your own management: qualify the need, choose an architecture, size the model and the hardware, set up the guardrails, build the agent, validate its findings and measure its performance.

What you will learn

  • The AI concepts needed to design an architecture: tokens, context window, tool calling, the agent loop, open models and API models
  • Which parts of a pentest an agent handles well, and which still need a human
  • How to choose between a cloud and a local architecture, and how to size GPUs, context and parallel sessions
  • How to keep an agent in scope: sandboxing, network filtering, command control, human approval, kill switch, tamper-evident logging
  • How to stop the target from manipulating the agent: prompt injection, misleading responses, redirects, DNS tricks
  • How to validate findings, write the report and measure false positives
  • What the CREST AI-Enabled Penetration Testing accreditation and the OWASP Autonomous Penetration Testing Standard (APTS) require

Four case studies

The same four cases run through every part of the course:

  • The in-house security team of a SaaS vendor that wants recurring tests in its CI pipeline and accepts cloud models
  • A web pentester who sets up an AI assistant in Burp Suite for their pentest team
  • A bank that allows no data to leave its network and wants its internal applications tested in a staging environment
  • An external test of an exposed attack surface on a limited hardware budget

Each part ends with a multiple-choice quiz. The course ends with a final case study: a new brief, handled from end to end through a series of multiple-choice questions.

Who this course is for

  • Pentest consultancies that receive client requests for AI-driven testing and need to answer them.
  • In-house pentesters and red teams who test their own organization's systems and want to automate part of the work safely.
  • Penetration testers with at least junior experience, who already know how an engagement runs: scoping, methodology, tools, reporting.
  • Pentesters who hear about AI everywhere and want to know how to use it well in their daily work, and to become the go-to person for AI in their pentest team.

Who this course is not for

  • Beginners in penetration testing. The course does not teach pentesting itself.
  • Anyone who wants to build agents for CTFs or benchmarks. Every choice in this course is made for real systems, real scopes and real consequences.
  • Anyone who wants the theory in depth. AI concepts are explained only as far as needed to design and size an architecture.
  • Anyone who wants to learn how to attack AI systems. The course covers attacks such as prompt injection, manipulated tool output and agent hijacking, but only to protect your own agent against them.

Share this course

Categories

Cyber SecurityPenetration TestingOffensive SecurityRed Teaming

Instructor

About the Instructor

autopen

Material

Course Material

  • Part I. Foundations

  • Introduction

  • Legal notice

  • Why agentic pentesting

  • The angle of this course

  • Who this course is for

  • How to follow it

  • The order of the chapters

  • The technical part

  • Quizzes

  • References

  • Recommended tools

  • What you will be able to do

  • The four case studies

  • Chapter 1. AI Fundamentals

  • 1.1 What an LLM is

  • How a model is trained

  • Consequences for a pentester

  • 1.2 Tokens and the context window

  • Tokens

  • The context window

  • How fast it fills up

  • What happens when it is full

  • 1.3 Tool calling

  • What this means for an architecture

  • 1.4 The agent loop

  • What a run looks like

  • Stop conditions

  • Typical failures

  • Agent or workflow

  • 1.5 Reasoning models

  • When reasoning helps

  • What it costs

  • When it does not help

  • 1.6 Open models and API models

  • What decides the choice

  • 1.7 What makes a good model for pentesting

  • How to compare models

  • Case studies

  • Quiz

  • Quiz 1

    3 attempts allowed

  • Chapter 2. What an Agent Can Do in a Pentest

  • 2.1 By phase

  • Reconnaissance

  • Enumeration

  • Vulnerability triage

  • Exploitation

  • Post-exploitation

  • Reporting

  • A test before delegating a task

  • 2.2 By type of test

  • Web applications and APIs

  • External tests

  • Internal tests

  • Cloud

  • Wi-Fi

  • Summary

  • 2.3 Where agents fail

  • Working around these limits

  • 2.4 What public studies show

  • Agents compared with professional pentesters

  • Capability failures and planning failures

  • Variability between runs

  • How to read these studies

  • 2.5 Autonomy levels

  • The same finding at three levels

  • Choosing the level for an engagement

  • Case studies

  • Quiz

  • Quiz 2

    3 attempts allowed

  • Part II. Design

  • Chapter 3. Scoping the Request

  • 3.1 Qualifying the need

  • What the requester actually wants

  • The questions to ask

  • One-off or recurring

  • 3.2 Constraints

  • Data confidentiality

  • Regulation

  • Network

  • Hardware

  • Budget

  • 3.3 Build or buy

  • When to buy

  • When to build

  • 3.4 Contractual aspects

  • Rules of engagement

  • Liability

  • Logs and data retention

  • Model provider terms

  • Informing the client

  • 3.5 Standards for AI-driven pentesting

  • CREST AI-Enabled Penetration Testing

  • OWASP Autonomous Penetration Testing Standard (APTS)

  • What they impose on the architecture

  • 3.6 Presenting the offer

  • 3.7 Decision grid

  • Case studies

  • Quiz

  • Quiz 3

    3 attempts allowed

  • Chapter 4. Four Reference Architectures

  • Common building blocks

  • 4.1 Full cloud

  • Context

  • Diagram

  • Components

  • Strengths

  • Limits

  • Indicative cost

  • 4.2 Burp extension connected to a model

  • Context

  • Diagram

  • Components

  • Strengths

  • Limits

  • Indicative cost

  • 4.3 Full local, large GPU

  • Context

  • Diagram

  • Components

  • Strengths

  • Limits

  • Indicative cost

  • 4.4 Full local, small GPU

  • Context

  • What changed with MoE models

  • Diagram

  • Components

  • Strengths

  • Limits

  • Indicative cost

  • 4.5 Comparing the four architectures

  • Variants and combinations

  • Quiz

  • Quiz 4

    3 attempts allowed

  • Chapter 5. Choosing and Sizing the Model

  • 5.1 Parameters

  • What size changes

  • Memory needed for the weights

  • 5.2 Mixture of experts

  • What it means for sizing

  • 5.3 Quantization

  • 5.4 KV cache

  • 5.5 Sizing method

  • Step 1. Context per session

  • Step 2. Number of simultaneous sessions

  • Step 3. Weights

  • Step 4. KV cache

  • Step 5. Overhead

  • Step 6. Map to GPUs

  • Step 7. Check the speed

  • A full example

  • 5.6 API cost versus amortized GPU

  • Cost of a run with an API

  • Cost of a local server

  • Break-even

  • 5.7 Fine-tuning

  • Case studies

  • Quiz

  • Quiz 5

    3 attempts allowed

  • Part III. Build and Secure

  • Chapter 6. Server, Harness and Tools

  • 6.1 Inference server

  • Role

  • Common options

  • Tool calling with a local model

  • 6.2 Inference server versus harness

  • 6.3 The layer between harness and model

  • What a gateway does

  • Masking, and its limits

  • Protect the gateway

  • 6.4 Tooling

  • A shell

  • Dedicated tools

  • A combination

  • How many tools

  • MCP

  • 6.5 Formatting tool output

  • Principles

  • Before and after

  • 6.6 Managing context on a long engagement

  • Strategies

  • 6.7 RAG

  • When it helps

  • When it does not

  • Case studies

  • Recommended tools

  • Quiz

  • Quiz 6

    3 attempts allowed

  • Chapter 7. Guardrails

  • 7.1 What can go wrong

  • The incidents to prevent

  • Threat modeling your own agent

  • 7.2 Scope control at several levels

  • Three levels

  • Why the prompt alone never suffices

  • Why the harness alone is not enough

  • Why the network alone is not enough

  • The scope as a file

  • Details that matter

  • 7.3 Sandboxing

  • Hardening a container

  • Which one to choose

  • 7.4 Sandbox without a proxy

  • Limits

  • 7.5 Sandbox with a proxy

  • 7.6 Command control

  • Allowlist rather than denylist

  • Options to watch

  • 7.7 Human approval of risky actions

  • Defining the risk

  • The approval request

  • Approval fatigue

  • 7.8 Rate limiting

  • Watching the target’s health

  • 7.9 Kill switch

  • Triggers

  • Test it

  • 7.10 Discovered credentials and secrets

  • Rules

  • 7.11 Prompt injection from the target

  • How it happens

  • Defenses

  • 7.12 Tamper-evident logging

  • What to log

  • Making alteration visible

  • 7.13 Isolation between clients and engagements

  • 7.14 Testing your guardrails before the engagement

  • A minimal test environment

  • Tests

  • 7.15 Self-assessment against the OWASP APTS

  • Method

  • Where to start

  • Case studies

  • Recommended tools

  • Quiz

  • Quiz 7

    3 attempts allowed

  • Chapter 8. Building the Agent

  • 8.1 Do you need a framework?

  • What a framework adds

  • What it costs

  • A practical rule

  • 8.2 General orchestration frameworks

  • 8.3 Vendor SDKs

  • Their limit for full local

  • 8.4 Pentest-specific frameworks

  • The main projects

  • The case of CAI

  • Criteria for choosing

  • Start from an existing project or build your own

  • 8.5 Multi-agent patterns

  • Orchestrator and workers

  • Pipeline by phase

  • Planner, executor, verifier

  • Parallelization

  • Cost and complexity

  • 8.6 Making agents work together

  • A shared findings store

  • Handoffs

  • Budgets per agent

  • Loop detection

  • Avoiding conflicts

  • Messages between agents are data

  • 8.7 System prompt and methodology

  • Structure

  • An example

  • Writing tips

  • 8.8 A complete example

  • The lab

  • The scope file

  • Scope checks

  • The audit log

  • The tools

  • The agent loop

  • The prompts

  • Running the test

  • Verification

  • Human validation and report

  • Guardrail tests

  • Running everything

  • What to expect

  • What is missing for a client engagement

  • Case studies

  • Recommended tools

  • Quiz

  • Quiz 8

    3 attempts allowed

  • Chapter 9. Reliable Results

  • 9.1 Validating findings

  • Hypothesis, finding, reported finding

  • Reproducible proof

  • Automated verification

  • An independent verifier

  • A verification, step by step

  • Common false positives

  • Confidence

  • Severity

  • 9.2 Assisted mode

  • Delegation

  • Review

  • Taking back control

  • The human’s responsibility

  • 9.3 Reporting and traceability

  • What changes in the report

  • Each finding

  • An example

  • Executive summary

  • Checking the agent’s text

  • The evidence package

  • Case studies

  • Quiz

  • Quiz 9

    3 attempts allowed

  • Part IV. Operate

  • Chapter 10. Evaluation and Operations

  • 10.1 Public benchmarks and their limits

  • The main benchmarks

  • By type of test

  • What they do not measure

  • 10.2 Metrics

  • Effectiveness

  • Accuracy

  • Cost and time

  • Safety

  • 10.3 Variability

  • Why one run proves nothing

  • Success rate and consistency

  • How many runs

  • Reducing variability

  • 10.4 Internal benchmark and regression testing

  • Building it

  • When to run it

  • Regression criteria

  • 10.5 Engagement runbook

  • Before

  • During

  • After

  • 10.6 Monitoring in production

  • Traces

  • Costs

  • Quality over time

  • Model changes

  • Track record

  • Case studies

  • Recommended tools

  • Quiz

  • Quiz 10

    3 attempts allowed

  • Chapter 11. Final Case Study

  • The brief

  • The organization

  • The request

  • What the team knows

  • Quiz: scoping

  • Quiz 11

    3 attempts allowed

  • Quiz: architecture

  • Quiz 12

    3 attempts allowed

  • Quiz: sizing

  • Quiz 13

    3 attempts allowed

  • Quiz: guardrails

  • Quiz 14

    3 attempts allowed

  • Quiz: building the agent

  • Quiz 15

    3 attempts allowed

  • Quiz: validation and reporting

  • Quiz 16

    3 attempts allowed

  • Quiz: evaluation and operations

  • Quiz 17

    3 attempts allowed

  • Closing

  • Appendices

  • A. Reference tables

  • GPUs

  • What to record for each candidate model

  • API models

  • Open-weight models

  • B. Recommended tools by section

  • C. Glossary

  • D. Prompts for your coding assistant

  • D.1 Scope file and scope checks

  • D.2 Firewall rules generated from the scope file

  • D.3 Hash-chained logger

  • D.4 Output formatter for a directory brute force

  • D.5 Minimal agent loop for architecture A

  • D.6 Gateway routing for architecture B

  • D.7 Local inference server for architecture C or D

  • D.8 Guardrail test suite

  • E. Quiz explanations

  • Chapter 1

  • Chapter 2

  • Chapter 3

  • Chapter 4

  • Chapter 5

  • Chapter 6

  • Chapter 7

  • Chapter 8

  • Chapter 9

  • Chapter 10

  • Chapter 11

The Leanpub 60 Day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

See full terms...

Earn $8 on a $10 Purchase, and $16 on a $20 Purchase

We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub