Knutsford – November 05, 2026 -- PortSwigger, the company behind Burp Suite, has made Burp AT available to enterprises. The agentic pentesting product lets security teams delegate anything from guided investigations to autonomous execution of defined tests, while Burp's tooling layer, not the AI model, enforces scope and permissions.
Burp AT gives AI agents professional pentesting tools and research-led methods
Burp AT combines specialist Burp tools, pentesting skills developed with PortSwigger Research, and application context. Agents plan their testing approach, use Burp's web security testing tools, and adapt as they learn. The tools are built to handle the malformed traffic and unusual behaviour inherent to security testing.
An orchestration layer ties the tools into a complete test, and agents follow defined pentesting methodologies. PortSwigger says this produces consistent, comparable results across every application tested.
"The agent brings the reasoning, and Burp brings the precision," said Tom Shelton-Lefley, Product Manager at PortSwigger.
Burp deterministically enforces scope while teams set the level of autonomy
Organisations can raise or lower delegated authority by application, task and risk appetite, and can step in when needed. Because Burp enforces the configured scope and permissions, agents cannot execute actions the tooling layer does not permit. Teams keep visibility into test activity and the evidence behind findings. Experts then assess that evidence to decide which weaknesses to address and where to investigate further.
PortSwigger targets AppSec teams short on expert capacity
PortSwigger aims the product at AppSec leaders balancing testing priorities against limited expert capacity. It is meant to help them pursue investigations that would otherwise wait, revisit applications as they change, and run in-depth testing more often across more of their estate.
Chris Wood, Product Manager at PortSwigger, said teams can now run agentic tests at scale with scope and safeguards set in advance, and can stop the agent and see what it is doing.
PortSwigger is exhibiting at OWASP Global AppSec USA in San Francisco, booth G14, on November 5 and 6.