PortSwigger today announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often.
Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger Research, and relevant application context. Agents plan their testing approach, use Burp’s web security testing tools, and adapt as they learn. They draw on application context and purpose-built skills developed with PortSwigger Research.
For AppSec leaders balancing testing priorities with limited expert capacity, Burp AT helps teams pursue investigations that would otherwise wait, revisit applications as they change, and carry out in-depth testing more often, over more of their estate.
Security teams choose how much authority to delegate, from guided investigations to autonomous execution of defined tests. Burp deterministically enforces configured scope and permissions, not the model itself, while experts assess the evidence to decide which weaknesses to address and where further investigation is needed.
Testing with specialist tools and research-led methods
Burp AT helps teams bring specialist testing depth to more applications, equipping agents with the Burp tools professional pentesters use and purpose-built skills developed with PortSwigger Research.
The specialist tools are designed to handle malformed traffic and unusual behaviour that is inherent to security testing. Research-led skills give agents structured methods to pursue promising leads and adapt to the evidence, so organisations get consistent, comparable results across every application they test.
Autonomy on the organisation’s terms
Organisations choose how much testing to automate and where their teams stay closely involved, from user-guided to autonomous execution of defined tests. Teams can increase or reduce the authority they delegate according to the application, task, and organisation’s risk appetite, whilst retaining the ability to step in when needed.
Whatever level of autonomy you choose, Burp enforces configured scope and permissions, not the model itself, meaning agents cannot execute actions the tooling layer does not permit, thus maintaining testing boundaries as more execution is delegated. Teams retain visibility into test activity and the evidence behind findings, giving them the oversight to assess results and make decisions about risk.
For organisations interested in Burp AT
To talk to us about Burp AT for your organisation, please fill out this form.
For more information, visit: https://portswigger.net/burp/burp-at.
Heading to OWASP Global AppSec USA in San Francisco this year? Meet the PortSwigger team at booth G14 on the 5th and 6th November. Request a meeting slot with the team
Related
This entry was posted on November 5, 2026 at 8:00 am and is filed under Commentary with tags PortSwigger. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
PortSwigger Scales Burp AT for Enterprise Testing Programmes
PortSwigger today announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often.
Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger Research, and relevant application context. Agents plan their testing approach, use Burp’s web security testing tools, and adapt as they learn. They draw on application context and purpose-built skills developed with PortSwigger Research.
For AppSec leaders balancing testing priorities with limited expert capacity, Burp AT helps teams pursue investigations that would otherwise wait, revisit applications as they change, and carry out in-depth testing more often, over more of their estate.
Security teams choose how much authority to delegate, from guided investigations to autonomous execution of defined tests. Burp deterministically enforces configured scope and permissions, not the model itself, while experts assess the evidence to decide which weaknesses to address and where further investigation is needed.
Testing with specialist tools and research-led methods
Burp AT helps teams bring specialist testing depth to more applications, equipping agents with the Burp tools professional pentesters use and purpose-built skills developed with PortSwigger Research.
The specialist tools are designed to handle malformed traffic and unusual behaviour that is inherent to security testing. Research-led skills give agents structured methods to pursue promising leads and adapt to the evidence, so organisations get consistent, comparable results across every application they test.
Autonomy on the organisation’s terms
Organisations choose how much testing to automate and where their teams stay closely involved, from user-guided to autonomous execution of defined tests. Teams can increase or reduce the authority they delegate according to the application, task, and organisation’s risk appetite, whilst retaining the ability to step in when needed.
Whatever level of autonomy you choose, Burp enforces configured scope and permissions, not the model itself, meaning agents cannot execute actions the tooling layer does not permit, thus maintaining testing boundaries as more execution is delegated. Teams retain visibility into test activity and the evidence behind findings, giving them the oversight to assess results and make decisions about risk.
For organisations interested in Burp AT
To talk to us about Burp AT for your organisation, please fill out this form.
For more information, visit: https://portswigger.net/burp/burp-at.
Heading to OWASP Global AppSec USA in San Francisco this year? Meet the PortSwigger team at booth G14 on the 5th and 6th November. Request a meeting slot with the team
Share this:
Like this:
Related
This entry was posted on November 5, 2026 at 8:00 am and is filed under Commentary with tags PortSwigger. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.