{"id":9340,"date":"2026-09-08T14:41:21","date_gmt":"2026-09-08T14:41:21","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9340"},"modified":"2026-09-08T14:41:21","modified_gmt":"2026-09-08T14:41:21","slug":"reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9340","title":{"rendered":"Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation.\u00a0<\/strong><\/p>\n

Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across complex web environments, and because they start from an existing model of each site, they cover up to ten times more than conventional pentesting tools.<\/p>\n

A pentest used to be an event. An engagement, a report, done. The report described a moment. The website kept going: login, checkout, payments, dozens of third-party scripts, all probed by attackers daily.\u00a0<\/p>\n

\u201cWebsites change every week and get pentested once or twice a year. That gap is where exposure builds up,\u201d said Idan Cohen, CEO and co-founder of Reflectiz. \u201cTeams need testing that keeps up with releases at a cost they can sustain, and trusted coverage of what was tested.\u201d<\/p>\n

While others start every test blind, Reflectiz already knows the website.<\/strong><\/p>\n

Reflectiz has spent a decade scanning thousands of production websites and holds a live model of each one: pages, scripts, third parties, domains, sensitive inputs, and behaviors. The pentesting agents add the attacker\u2019s perspective to that same model.<\/p>\n

A finding does not arrive as a line item. It arrives with the script involved, the data it can reach, and whether real users are exposed right now, allowing teams to skip the investigation and go straight to the fix.<\/p>\n

\u201cThe hard part of web pentesting was never the payload. It was understanding what the application actually does,\u201d said Ysrael Gurt, CTO and co-founder of Reflectiz. \u201cOur engine has been reading live websites for years, so our agents start with a map of the site that other tools never build.\u201d<\/p>\n

A team of specialized agents, not another scanner<\/strong><\/p>\n

The agentic pentesting runs as a coordinated team of AI agents, each with a defined role:<\/p>\n

One agent crawls the site the way a real user does, through logins, one-time codes, and 2FA, mapping what is actually there.<\/p>\n

A second fingerprints the stack and works out which attacks apply where.<\/p>\n

A third runs those attacks and chains what it finds.<\/p>\n

The fourth matters most: an independent validator reproduces every finding before it reaches the report. False positives are removed by design.<\/p>\n

The result:<\/strong> findings with reproduction steps and evidence, plus a coverage map of what was tested and cleared.\u00a0<\/p>\n

Testing spans the full OWASP Top 10<\/a>, and teams set depth per flow, from fast predefined checks to expert-level attack chains on critical assets.\u00a0<\/p>\n

Completing the 360\u00b0 map of web risk<\/strong><\/p>\n

The agentic pentesting, part of the new Offensive Hub, joins Security Hub and Privacy Hub on the Reflectiz platform, completing a 360\u00b0 map of web risk: what runs on the website, what data it touches, and how it can be attacked.<\/p>\n

One exposure picture.<\/strong> Findings from all three hubs cross-reference automatically, no dashboards reconciled by hand.<\/p>\n

Guided fixes.<\/strong> Atlas, the Reflectiz AI remediation agent, explains each risk and walks the team through the fix.<\/p>\n

Existing workflows.<\/strong> Results route into current operations through a REST API, CI\/CD triggers, and Slack alerts.<\/p>\n

See it live<\/strong><\/p>\n

Reflectiz founders Idan Cohen and Ysrael Gurt will demonstrate the agentic pentesting in a live webinar on September 15 at 11 AM ET \/ 6 PM CET.<\/p>\n

Registration: https:\/\/www.reflectiz.com\/lp\/founders-case-study-webinar\/<\/a><\/p>\n

Product information: Reflectiz Offensive Hub<\/a> | Walkthrough Video<\/a><\/p>\n