Pen-testing that doesn’t stop at the report. It stays until the fix ships.

A pen-test finds the flaw in days. The fix takes a quarter.

The pen-test report arrived as a PDF: forty pages, a severity per finding, a recommended fix. Then the hard part began, and none of it was testing. Someone had to prove each finding was real, find the code, convince a developer, protect production in the meantime and check the fix actually held.

One red-team harness. Testing, fixing and protecting in one loop.

The same agent factory, with a red-team harness. At its centre is an application map (routes, roles, APIs and the code behind them), plus the rules of engagement, owners and approvers, guardrails, memory, their tools, their model and the registers. Optimus handles the open-ended attack work; multi-agent workflows handle the steps that must run the same way every time.

Optimus attacks like a tester, and reports only what it proves.

Optimus maps the application, forms its own hypotheses (business-logic abuse as well as the OWASP Top 10), and tries them inside the rules of engagement. A hypothesis is not a finding: a flaw is reported only when the exploit works, with the request, the response and the steps to reproduce.

The fix arrives as a pull request, and the agent stays for the review.

A workflow agent writes the fix in the developers’ own code style and opens a pull request on a branch, with the proof attached. Then it does what a PDF never could: it reads the review, understands the comment, adapts the change and pushes again. It never merges its own pull request, a developer does.

- const order = await Orders.findById(req.params.id);+ const order = await Orders.findOne({ id: req.params.id, ownerId: req.user.id });+ if (!order) return res.status(404).end();

Critical and unprotected? A WAF rule holds the line, safely, until the fix ships.

When a flaw is critical and nothing in front of the application stops it, the agent doesn’t wait for the sprint. It drafts a WAF rule that matches the exploit and deploys it in count mode (logging, not blocking), so it can’t break legitimate traffic. A second agent watches the logs; only after a federated human-in-the-loop approval does the rule switch to block. When the fix merges and the re-test passes, the rule is retired.

name     orders-idor-temp
match    GET /api/orders/*
         > 20 distinct order IDs
         per session in 5 minutes
action   COUNT
expires  when PR is merged
         and the re-test passes

No finding goes quiet. Critical ones climb fast.

Every finding has an owner and an SLA set by its severity. The agent follows up in the pull request and in Teams; when the SLA is breached it escalates, and a critical flaw with no protection in front of it goes straight to the people who can accept or fund the risk.

Agents test and propose. People merge, block and accept.

An agent that attacks applications and writes code needs tighter boundaries than any other. They are set per action, by risk, and some capabilities are removed outright.

From the first app to every app.

The rollout