Our approach

AI agents for coverage. People for proof.

Every engagement combines AI agents running on local and client-approved API models with experienced testers. A person reproduces every finding before it reaches your report, and we retest after you fix it.

Request a security review ↗Our guarantee ↗
01 / Agentic testing

How do you use AI agents in penetration testing?

Agents cover ground quickly. Testers go deep where judgment matters. Nothing is reported until a person has reproduced it.

Local models

Self-hosted LLM agents

Agents on self-hosted models run inside our isolated testing environment for reconnaissance, attack surface mapping, fuzzing, and hypothesis generation. Your code, traffic, and data stay in that environment.

API models

Frontier models over API

For harder reasoning and exploit chaining we can add frontier models over API. We only do this with your written approval and under the provider’s no-training and retention terms.

Manual testing

Experienced testers

Our testers go after business logic, authorization, multi-step workflows, and chained attack paths. These are the issues that need a tester’s judgment.

Human triage

A person validates every agent result

On every engagement we compare what the agents found with what our testers found, and look closely at anything only one side caught. That keeps false positives out of your report and shows us where each approach is strongest.

  • Agent and manual results compared per engagement
  • No unverified findings in the final report
  • Client data never used to train models
02 / How we work

How does a Hackstack Security engagement work?

Four steps, from a signed scope to confirmed fixes.

Step 1 of 4

Define

We agree targets, objectives, rules of engagement, and the decision the assessment has to support. All of it is in writing before testing starts.

What you get from this step
  • Signed authorization and scope
  • Rules of engagement and test window
  • Named contacts on both sides
  • Severity method and guarantee terms, if eligible
Step 2 of 4

Test

AI agents map and probe the attack surface while our testers work through business logic, access control, and chained attacks by hand. A person reviews every agent result.

What you get from this step
  • Attack surface map
  • Agent and manual results, compared
  • Critical issues reported as found, not at the end
  • Evidence captured for each finding
Step 3 of 4

Explain

We deliver validated findings with business impact, reproduction steps, and fix guidance your engineers can act on, then walk your team through them.

What you get from this step
  • Executive summary
  • Technical findings with CVSS vectors
  • Reproduction steps and evidence
  • Readout call with your team
Step 4 of 4

Verify

We retest the fixes you ship and record the final status of every finding, so you have something to show customers and auditors.

What you get from this step
  • Retest of agreed fixes
  • Closure status per finding
  • Updated report
  • Attestation letter on request
03 / Reporting

What does a Hackstack Security finding look like?

Every finding in our reports follows this format, so engineers can reproduce it and leadership can judge the risk.

HS-API-004

Invoice export allows cross-tenant data access (IDOR)

High · CVSS 7.1
Asset
api.example.com · GET /v2/invoices/{id}/export
CVSS 3.1 vector
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Found by
Local-model agent flagged sequential IDs; confirmed manually by a tester
Status
Closed, verified on retest

Impact

Any signed-in user can download another tenant’s invoices, including customer names, addresses, and payment amounts, by changing the invoice ID in the request.

Remediation

Look up invoices by the tenant in the user’s session and return 404 for any invoice outside it. Add an automated authorization test that requests another tenant’s invoice and expects a 404.

Evidence

GET /v2/invoices/48213/export HTTP/1.1Host: api.example.comAuthorization: Bearer <tenant A user token> HTTP/1.1 200 OKContent-Type: application/pdfX-Tenant-Id: 1187   (invoice belongs to tenant B)

Example of our finding format. The asset, IDs, and values are placeholders, not client data.

04 / Why Hackstack Security

Why choose Hackstack Security over a scanner or a checklist pentest?

We explain each risk, make the fix practical, and confirm it worked.

Approach comparison

How common testing approaches typically cover what matters.

ApproachHuman-validatedAgentic + manual depthFix + retest
Automated vulnerability scanners No No No
Checklist-driven compliance pentests Varies No No
Open bug bounty programs Varies Varies No
Hackstack Security Yes Yes Yes

Generalized comparison of common approaches. Individual providers and programs vary.

Start with a focused conversation

Tell us what you need tested.

Share your targets, deadline, and any compliance driver. We reply with a proposed scope, test approach, and timeline. There is no obligation.

Request a security review ↗Explore services ↗