Run Your First AI Penetration Test

Overview

An AI penetration test is run by autonomous agents rather than a human tester. You define the target and scope, and the agents run the engagement automatically, confirming exploitable findings with proof and delivering a consolidated report.

This guide walks through purchasing credits and launching your first AI penetration test. For expert-led engagements and CSV-imported findings, see Penetration Testing.

Prerequisites

The Administrator or Team Member role in your Fencer organization. Other roles don’t see Start a test.
A verified target domain (or a verified shared-hosting host). You can add and verify a domain from the wizard’s first step, or beforehand under Posture > Domains.
At least one available AI penetration test credit. Check your balance under AI Pentests on the Usage tab of Admin > Billing.

How credits are used

Each run uses one credit, drawn as soon as you start (or schedule) the test. Re-running a test uses another credit. If a run finishes without reporting any vulnerability, or you stop it with Stop pentest, the credit is returned.

Purchase AI penetration test credits

If you are on a trial or have used all your credits, buy more from the Billing page.

In the left navigation, click Billing under Admin.
Make sure the Billing tab is selected. Only users who can edit organization settings see this tab.
Scroll to the AI penetration test credits section and click Buy More to complete the purchase.

When your organization is out of credits, the Usage tab shows a Buy AI pentest credits button, and the AI agent option on the driver-selection screen is shown as locked with an Out of credits badge. Selecting it takes you straight to the Billing page with the credits checkout open.

Start a new test

In the left navigation, click Posture > Penetration Testing.
In the page header, click Start a test.
On the Who should perform the test? screen, select AI agent.
- AI agent — configure the target and scope, then the agent starts testing automatically.
- Security expert — send a request to Fencer and coordinate the scope and schedule with a human tester.

Direct link: https://app.fencer.dev/a/<organization-slug>/penetration-testing/new/

Configure the test

The setup wizard has four steps. Complete each in order.

Step 1: Target — pick a domain

Direct link: https://app.fencer.dev/a/<organization-slug>/penetration-testing/new/?driver=ai&step=target

Primary domain

Choose Domain (a verified domain you own) or Shared-hosting host (a named host on shared infrastructure).
Search for and select the domain you want to test. This anchors the authorization boundary for the engagement. If the domain isn’t verified yet, use Add a domain or Verify to prove you control it.

Additional in-scope domains (optional)

Add another verified domain if your application reaches into it — a separate API, a login service, a sibling product. For example, if your app at app.domainA.com calls an API at domainB.net, add domainA.com as the primary domain and domainB.net here. Each domain is still tested from its own entry points, and a test login you give to one domain is never replayed against another. Any request to a domain that isn’t listed is treated as third-party and left untouched.

Additional in-scope hosts (optional)

Add another verified shared-hosting target if the engagement should also cover it. Each host is tested by its exact name only — nothing else on the shared platform is touched.

An engagement covers at most 11 targets in total. When ready, click Analyze.

Step 2: Analyze — map the surface

Fencer maps the attack surface of your target: it resolves DNS records and certificates, enumerates subdomains, probes live hosts and services, and classifies environments. This usually takes a couple of minutes, and the wizard moves on to Scope when it finishes. If it takes too long or fails, choose Skip and configure the scope manually (or Try again).

An engagement made only of shared-hosting hosts skips this step.

Step 3: Scope — scope and credentials

Define the attack surface: which discovered hosts to Include (in scope) or Exclude (out of scope), plus pattern rules under Fine-tune scope. Use Settings on a host to give the agent a start endpoint and the test logins it needs. The agent signs in with each set of credentials and roles you provide, so supplying credentials for every role you want covered widens what the test can reach. Private IP ranges aren’t allowed in scope.

Step 4: Details — purpose, timeline, and contact

Choose when testing should start (Start immediately or Schedule a start time), whether there is a completion deadline, the application and environment type, and the contact details: an optional Penetration test title, a Contact email (your account email if left blank), and any Special context or notes. Then click Start AI pentest.

After you submit

The AI agents begin the penetration test at the chosen time. Track progress and review findings under Posture > Penetration Testing. While the test runs, the Scans tab shows a live activity feed of the coordinating agent and the specialist sub-agents it delegates to, and Stop pentest ends the run and refunds the credit.

Findings are rated by severity (Critical, High, Medium, Low, Info) and flow into the same vulnerability pipeline as every other Fencer scan, so you can triage, assign, and report on them alongside the rest of your findings. When you’ve fixed a finding, mark it Ready for Verification; an agent re-checks it and resolves or reopens it.

Once the run finishes, the page header offers:

PDF — the Initial Report, Executive Summary, and Remediation Report.
Refine & run — start a new test prefilled with this one’s settings.
Rerun test — shown instead when the run failed.

If the run found hosts it wasn’t allowed to test, they appear on the Untested hosts tab. Select the ones you want and click Add to scope & rerun.

Troubleshooting

The domain you want to test does not appear in the search — the domain is not verified yet. Verify it from the Target step or under Posture > Domains first.
The AI agent option is locked — your organization is out of credits. Selecting the locked card opens the Billing page with the credits checkout ready.
“This organization has reached its AI pentest usage limit.” — buy more credits, then start the test again.
You don’t see Start a test — starting a test requires the Administrator or Team Member role.
You cannot see the Penetration Testing module — penetration testing is a paid feature and must be enabled for your organization.

Questions?

Contact support@fencer.dev or use the in-app Support button in the bottom-left corner.