Frequently Asked Questions

Infiltra.ai is an autonomous, AI-driven security testing platform designed to help security and engineering teams validate exploitability and ship secure software faster. Infiltra provides two dedicated product lines:

• Web App & API Penetration Testing: Continuous, autonomous pentesting that discovers vulnerabilities, tests authenticated multi-step business logic, validates exploits with concrete proof of impact, and provides signed Letters of Attestation (LoA).
• LLM Application & AI Agent Red Teaming: Purpose-built adversarial red teaming that tests generative AI and autonomous agentic systems for prompt injection, jailbreaks, tool manipulation, memory leakage, and OWASP-mapped risks.

You can test your entire modern software ecosystem across web layers and artificial intelligence:

• Web Applications & SPAs: Modern single-page applications (React, Angular, Vue, Next.js) and server-rendered portals.
• REST & GraphQL APIs: Microservices, internal/external endpoints, and authenticated API gateways.
• LLM Applications: Customer-facing chatbots, internal copilots, and retrieval-augmented generation (RAG) knowledge systems.
• Autonomous AI Agents: Multi-step agentic workflows integrated with tools, database connectors, function calling, and Model Context Protocol (MCP) servers.

AI penetration testing uses autonomous AI agents to replicate the investigative methodology, curiosity, and chain-of-exploit reasoning of an experienced human penetration tester. Unlike legacy DAST scanners that simply match static vulnerability patterns and generate overwhelming alert noise, Infiltra's agents:

• Autonomously crawl, discover, and map application workflows and hidden parameters.
• Authenticate and maintain sessions through modern multi-step login and MFA flows.
• Actively test complex business logic and sequence manipulation.
• Verify exploitability safely and capture clear proof of impact before reporting.

Learn more in our guide: What is AI Penetration Testing?

Yes. Infiltra provides purpose-built AI red teaming that adversarial tests both LLM applications and autonomous agentic workflows. We simulate sophisticated attacker techniques targeting prompt injection, safety guardrail evasion, tool execution hijacking, memory poisoning, and system instruction extraction.

All tests are mapped against the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications. Learn more on our LLM & AI Red Teaming Page.

LLM Application red teaming is the structured, adversarial evaluation of applications that integrate large language models. Our tests systematically evaluate:

• Direct Prompt Injection: Adversarial inputs designed to override developer instructions or bypass moderation filters.
• Indirect Prompt Injection: Malicious instructions embedded inside retrieved documents, user uploads, emails, or third-party web content.
• RAG Data Exfiltration: Techniques that coerce the model into leaking confidential vector embeddings or unauthorized documents.
• Unsafe Output Handling: Vulnerabilities where unfiltered or manipulated model responses are piped into downstream tools, database queries, code interpreters, or system workflows without strict validation.

AI Agent red teaming focuses on autonomous and semi-autonomous systems that have agency—meaning they can plan steps, query databases, call external APIs, and execute actions. Our testing assesses:

• Excessive Agency & Permissions: Whether an attacker can trick an agent into executing privileged tools or modifying unauthorized records.
• Instruction Hierarchy Hijacking: Overriding system instructions via crafted user requests or untrusted external inputs.
• Memory & Context Poisoning: Inserting malicious instructions into the agent's short-term or long-term vector memory to influence future sessions.
• Model Context Protocol (MCP) & Tool Security: Validating whether tool schemas, parameters, and invocation tokens can be exploited.

They assess distinct yet complementary layers of modern software:

• Web App & API Pentesting evaluates deterministic application logic and infrastructure: user authentication, session security, SQL injection, IDOR, authorization gates, and cloud misconfigurations.
• AI Red Teaming assesses probabilistic and cognitive behaviors: semantic prompt injections, instruction hijacking, vector memory poisoning, tool execution safety, and LLM safety alignment.

Because most modern AI applications wrap intelligence inside web APIs, combining both product lines ensures comprehensive security from your network perimeter to your model prompt.

Yes. Infiltra maps every red-team attack scenario and verified finding directly to established security standards:

• OWASP Top 10 for LLM Applications: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM04 Model Denial of Service, LLM06 Excessive Agency, LLM07 System Prompt Leakage, and LLM08 Vector & Embedding Weaknesses.
• OWASP Top 10 for Agentic Applications: Covering autonomous execution risks, tool authorization bypasses, and unconstrained action loops.

Every scenario represents a deterministic, reproducible adversarial attack against your target with detailed remediation guidance.

Unlike traditional static software, AI systems are non-deterministic, highly context-dependent, and continuously evolving. Multiple testing cycles are essential for:

• Remediation Verification: Confirming that updated system prompts, input filters, or guardrails successfully neutralize vulnerabilities without breaking intended functionality.
• Prompt & Tool Iterations: Every change to system prompts, user persona instructions, or available API tools alters the agent's decision boundaries.
• RAG Knowledge Base Ingestion: Adding new enterprise documentation or external data sources introduces vectors for indirect prompt injection.
• Model Version Updates: Upgrading underlying foundation models can degrade instruction adherence or bypass existing safety filters.

Yes, retesting is strongly recommended. Model providers frequently update weights, alignment tuning, and safety filters. Even minor version upgrades (e.g. from GPT-4o mini to a newer checkpoint or Claude 3.5 Sonnet updates) can alter:

• How rigidly the model adheres to your system prompt boundaries.
• The model's susceptibility to roleplay jailbreaks and multilingual obfuscation.
• How carefully the model validates tool parameters before issuing API calls.

A quick regression red-team run gives engineering teams confidence before rolling model changes to production.

No source code access is required. Infiltra tests your AI applications and agents via their external interfaces—such as web chat components, REST API endpoints, WebSockets, or webhook hooks—replicating exactly how external attackers interact with your system.

If you choose to provide grey-box context (such as high-level architecture notes, system prompt guidelines, or tool definitions), our platform leverages this context to synthesize highly targeted adversarial test suites.

Yes. Business logic flaw detection is a major differentiator for Infiltra. Legacy scanners look for static syntax matches, completely missing stateful and procedural logic flaws. Infiltra's autonomous agents understand application state and context:

• Step Skipping & Workflow Tampering: Bypassing payment confirmation, onboarding gates, or two-person approval steps.
• Insecure Direct Object References (IDOR): Accessing or modifying records belonging to other tenants or users.
• Price & Parameter Tampering: Manipulating hidden quantities, negative pricing values, or discount codes.
• Role-Based Privilege Escalation: Transitioning between standard and administrative roles without proper authorization.

Yes. Infiltra provides comprehensive support for authenticated testing across both Time-Based One-Time Password (TOTP) and Out-of-Band (OOB - SMS / Email) multi-factor authentication workflows:

• Fully Automated TOTP MFA: Infiltra's Browser Agent is powered by an advanced multimodal vision model capable of visually inspecting and navigating complex login portals, interacting with custom UI elements, submitting primary credentials, and calculating and filling the TOTP code automatically from the configured secret seed—exactly like an expert manual penetration tester.
• Human-in-the-Loop Out-of-Band MFA (SMS / Email): For out-of-band codes delivered via SMS or email, Infiltra employs a coordinated human-in-the-loop flow:
  • The system first verifies the user's real-time availability before kicking off the assessment.
  • The Browser Agent executes the first-factor login sequence.
  • The user is prompted to submit the second-factor code received via SMS or email.
  • The Browser Agent takes the submitted code and enters it to finalize authentication.
• Automatic Auth State Injection: Once authentication succeeds, the authenticated browser session state (session tokens, cookies, headers, and local storage) is automatically injected into Infiltra's reconnaissance, crawler, and vulnerability testing engines to perform thorough authenticated testing.

Infiltra eliminates triage noise through active verification and exploit validation rather than theoretical pattern matching:

• Web App & API Testing: When our agents suspect a potential flaw, they execute non-destructive exploit payloads to confirm exploitability and capture concrete proof of impact (such as response diffs, extracted test records, or execution traces) before generating an alert.
• AI Red Teaming: Every finding includes an exact, deterministic interaction trace showing the conversation turns or injection payload that successfully triggered the unwanted behavior.

If an issue cannot be confirmed with evidence, it is not reported as a vulnerability, saving your engineering and security teams hundreds of triage hours.

Yes. Retesting is built into the core workflow of both product lines. When your engineers release a fix:

• Click Retest on the specific vulnerability in your dashboard.
• Infiltra's agents immediately rerun the original attack sequence against the target endpoint to verify whether the fix is robust.
• If the vulnerability is successfully remediated, the finding status updates to "Resolved" and your compliance documentation is refreshed automatically.

Yes, for Web App & API assessments. Once vulnerabilities identified during testing have been fixed and validated through our retesting workflow, you can request an official Letter of Attestation (LoA) directly from the customer dashboard.

Our certified Subject Matter Experts (SMEs) manually verify the assessment trace logs and issue an executive-signed, audit-ready Letter of Attestation accepted by SOC 2 Type II auditors, ISO 27001 assessors, enterprise procurement teams, and cyber insurance underwriters.

No installation is required. Infiltra is 100% cloud-native SaaS. All assessments run on demand or on schedule from our dedicated, isolated cloud testing nodes.

For internal staging portals or environments behind firewalls, we provide static outbound IP ranges for easy whitelisting, as well as lightweight private runner gateway options for Enterprise customers.

Yes. Infiltra is built to fit seamlessly into automated DevSecOps pipelines:

• CI/CD Pipelines: Trigger regression assessments via GitHub Actions, GitLab CI, CircleCI, or custom webhooks during staging releases.
• Issue Tracking & Alerts: Synchronize findings directly into Jira, Linear, GitHub Issues, and Slack security channels.
• GRC Platforms: Export audit-ready reports in structured JSON, CSV, and executive PDF formats for easy ingestion into Vanta, Drata, Sprinto, and Anecdotes.

Customer data protection, isolation, and privacy are fundamental pillars of Infiltra's platform architecture:

• Ephemeral Assessment Sandboxes: Each test runs inside an isolated, short-lived containerized processor that is completely wiped upon scan completion, eliminating cross-scan or cross-customer contamination.
• Tenant-Specific Encryption: All configuration data, credentials, and scan findings are encrypted in transit via TLS 1.3 and at rest with customer-isolated AES-256 encryption keys.
• Data Residency & Sovereignty: Choose where your assessment processors and scan reports are hosted (United States, Australia, or European Union).

Infiltra offers transparent annual subscriptions with predictable monthly rates across both product lines:

• Web App & API Penetration Testing:
  • Free Tier: $0 (1 project, 1 application, 1 assessment/year).
  • Starter Plan: $250/mo ($3,000 billed annually) for 2 apps & 2 assessments/month.
  • Premium Plan: $500/mo ($6,000 billed annually) for 10 apps & 10 assessments/month.
  • Enterprise Plan: Custom volume, unlimited applications, CI/CD API support, and dedicated SLA.
• LLM & AI Red Teaming:
  • Starter Plan: $415/mo ($5,000 billed annually) for 1 LLM app/agent & 2 red-team assessments/month.
  • Premium Plan: $750/mo ($9,000 billed annually) for 3 LLM apps/agents & 6 assessments/month.
  • Enterprise Plan: Custom AI agent volume, custom attack scenarios, and CI/CD integration.

Explore complete feature comparisons on our Pricing Page.