Introducing Link
An agentic penetration tester for authenticated web applications.
Link is Sprocket's AI penetration tester agent for authenticated web applications. It logs in with user role credentials, as real users would, and can hold several roles at once, using them to test escalating access, business logic, and broken access controls across role boundaries. Suspected findings are validated before they're recorded, then handed to our testing team to review and publish.
Link is an extension of our testing team, not a replacement for it.
Authenticated Penetration Testing
How Link Works
- Multi-role by design. Every valid credential set for an application runs in the same test, one authenticated session per role, so Link demonstrates cross-role access instead of reporting a hunch on a single role's permissions.
- Autonomous. Maps the authenticated application, forms a theory about which boundary will fail, and tests that theory. Reasons through the app's business logic rather than running a deterministic scan.
- Context-aware. Knows your web assets and past findings, so it skips issues already open, catches previously fixed vulnerabilities that regressed, and judges severity against your actual environment.
- Human-owned. A member of the testing team reviews and publishes Link's findings before they reach you.
What you get
Attack Narratives
An Attack Narrative is written for every run, covering what was tested, whether or not it produced a finding.
Findings
Findings are delivered in the platform and through the API, exactly like every other finding. No new dashboards, no new process.
Each finding includes a severity, a clear description, a real proof of concept, remediation guidance, and references.
Built for trust
Credential security
Credentials are encrypted at rest and never handed to Link directly. At dispatch they're stripped from the job record and delivered as an isolated, restricted secret readable only by that run. Link authenticates using a login script, not your stored password.
Hosting
Link runs entirely inside Sprocket's AWS environment using frontier models, in trusted data centers that don't train on customer data.
Confirmed scope only
Only web applications you've confirmed you own and authorized for testing are ever in scope.
Non-destructive
Link tests in a measured, controlled, non-destructive way for production environments. Anything it writes is its own test data, which can be reversed and cleaned up at the end of testing.
Kill switch
Stop Testing, the platform's existing kill switch, halts Link along with any other active testing.
Who will see Link
WebApp customers with credentials
Link isn't active for every customer by default. It runs against a web application engagement when your team has provided at least one role's credentials for that application, kept valid on a recurring check.
Questions?
Want Link added to your web application testing, or need to get credentials uploaded for a role? Reach out to your Account Manager to get started.
Further Reading
Explore Latest Content.
How Combined AI and Manual Testing Discovered Two Zero Days
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days. read more →
Read more