WASA AI
Agentic AI Penetration Testing Platform
The firepower of a senior security team with the privacy of never leaving your machine. 150+ professional-grade tools, orchestrated by autonomous AI agents that reason, plan, execute, and adapt - all running 100% locally on your device.
The Security Industry Is Failing Organisations
Existing solutions aren't fixing it. Here's why - and how WASA AI is different.
Expertise Is Scarce & Expensive
Qualified pentesters command $150-$500+/hour. Most organisations can only afford annual assessments - leaving 364 days of exposure.
Autonomous AI agents that reason, plan, adapt, and act like a coordinated team of senior pentesters.
Tools Are Fragmented
A professional pentester juggles dozens of tools. Each has its own interface, output format, and learning curve. Stitching results together is manual and error-prone.
150+ tools orchestrated by agentic AI under one unified interface - the AI selects, configures, and chains tools autonomously.
Reports Are Suboptimal
Most reports are disappointingly generic. Copy-pasted boilerplate. Vague remediation. Template-driven artifacts that communicate compliance - not actual risk.
AI-written reports with exact evidence trails, step-by-step exploitation proof, and actionable remediation - not boilerplate.
Cloud Solutions Demand Your Data
Most AI-powered platforms require you to upload your most sensitive security data - the exact roadmap an attacker would need.
Everything runs locally - your data never leaves your device, ever. Air-gapped capable.
The CITP Agentic Pipeline
Our proprietary Component-Integrated Token Pools architecture mirrors how expert penetration testing teams actually work.
REASONER
Analyses findings, suggests hypotheses
PLANNER
Builds attack plans & tool chains
EXECUTOR
Runs tools, handles results, adapts
REPORTER
Compiles evidence, writes reports
Each component operates with its own independent resource pool - deep analysis in one phase never starves another.
The 11-Phase Workflow
Scope Validation
Passive Discovery
Target Classification
Risk Hypothesis
Safe Testing
Focused Testing
Correlation
Escalation Analysis
Controlled Exploitation
Regression Verification
Reporting
Hard gates between stages - the same methodology used by professional red teams.
Core Platform Capabilities
Intelligent Reconnaissance
- Network Discovery
- Subdomain Enumeration
- Technology Detection
- OSINT (100+ social networks)
- API Endpoint Mapping
Vulnerability Scanning
- Template-Based Scanning
- Web App Testing (SQLi, XSS, SSRF...)
- API Security Testing
- Infrastructure Scanning
- WAF Detection & Evasion
Exploitation & PoC
- Controlled Exploitation
- Attack Chain Building
- Session Management
- Credential Validation
- Evidence-Backed Proof
Knowledge-Augmented Analysis
- Extensive Security Corpus
- Real-Time CVE Enrichment
- Live Intelligence Lookups
- Cross-Framework Correlation
The AI That Gets Smarter With You
Your instance of WASA AI learns from every assessment - becoming more effective, more efficient, and more attuned to your specific environment over time. This isn't generic AI - it's your AI.
Experience-Driven Improvement
Every engagement becomes training data for your personal AI. Records what worked, what didn't, and what patterns lead to the most impactful discoveries.
Adaptive Strategy
Learns which approaches are most effective against specific target types. Web app vs API vs network - entirely different strategies, adapted automatically.
Intelligent Exploration
Actively prevents falling into a rut. Explores novel attack surfaces, varies approaches, tries creative combinations.
Rapid Adaptation
New e-commerce site? The AI already knows the most productive sequences from previous assessments. Time-to-first-finding drops dramatically.
Reusable Attack Strategies
High-impact patterns automatically extracted and stored as reusable playbooks that improve every future assessment.
Continuous Reasoning Improvement
Learning is woven into real-time decision-making. Tool selection literally improves with each engagement.
What This Means for You
First scan
Performs like a competent junior pentester
After 10 scans
Starts recognising patterns specific to your environment
After 50 scans
Operates like a senior pentester who has worked with your systems for years
Ongoing
Never forgets, never gets tired, never misses a pattern it has seen before
Your testing patterns, your environment knowledge, your hard-won insights never leave your device or train anyone else's model.
150+ Integrated Security Tools
You don't need to install, configure, or learn any of them individually - the AI agents autonomously select the right tool, configure it, execute it, and interpret the results.
Network Discovery
Port scanning, service detection, OS fingerprinting
Web Application
Directory brute-forcing, CGI scanning, CMS vulnerabilities
Subdomain Enumeration
Passive & active discovery, DNS zone analysis
Vulnerability Scanning
Thousands of templates, CVE matching
Web Proxy & Interception
Spider crawling, active scanning, API testing
Exploitation
Exploit execution, payload generation, session handling
SQL Injection
Automated SQLi detection, database extraction
Command Injection
Injection detection, exploitation, evasion
Credential Testing
Brute-force, password spraying, validation
SMB/LDAP/Kerberos
Share enumeration, Kerberoasting, NTLM relay
OSINT
Social media (100+ networks), email harvesting
Technology Detection
Framework detection, WAF identification
SSL/TLS Analysis
Certificate validation, cipher suite analysis
Agentic Tool Selection
Context-Aware
Agents choose tools based on target type, scan phase, and findings discovered
Parameter Optimisation
Agents tune parameters based on what they've learned from previous engagements
Failure Recovery
If a tool fails or times out, agents seamlessly adapt and fall back
Chain Orchestration
Agents sequence tools in logical attack chains, adjusting dynamically
13+ Specialised AI Agents
A team of autonomous, specialised AI agents - each an expert in a specific domain. They independently reason, make decisions, and collaborate with each other.
Reconnaissance Agent
Passive info gathering, OSINT, DNS, subdomain discovery
Vulnerability Agent
Scanning, template-based detection, severity classification
Exploitation Agent
PoC execution, exploit validation, controlled exploitation
Compliance Agent
Framework mapping, control assessment, gap analysis
Correlation Agent
Cross-target finding correlation, attack chain identification
Credential Agent
Credential extraction, validation, and testing
Privilege Escalation Agent
Local/domain escalation path discovery
Evasion Agent
WAF/IDS/EDR bypass analysis and testing
Finding Research Agent
Deep-dive CVE research, exploit database lookups
Finding Enrichment Agent
Automated CVSS scoring, CWE/CAPEC/ATT&CK mapping
Exploit Tracking Agent
Tracks exploitation gaps, unaddressed vectors
Learning Agent
Extracts and applies patterns from engagements
Report Agent
Generates executive, technical, compliance reports
Pro-tier users and above: Create your own custom agents - define specialisation, tool access, and knowledge base.
11+ Compliance Frameworks
Compliance agents automatically map every finding to the regulatory frameworks that matter. Hundreds of controls - compliance reporting becomes automatic, not an afterthought.
NIST CSF 2.0
Core functions and categories
NIST 800-53 Rev5
Full security controls catalogue
NIST SSDF
Secure software development
OWASP ASVS v4.0
Application security verification
OWASP SAMM v2.0
Software assurance maturity
ISO 27001:2022
Information security management
ISO 27035
Incident response management
PCI-DSS v3.2
Payment card security
HIPAA Security Rule
Healthcare data protection
SOC 2
Service organisation controls
CIS Controls v8
18 critical security controls
MITRE ATT&CK
Adversary tactics & techniques
Finding-to-Control Mapping
Every vulnerability automatically mapped to relevant controls across all frameworks
Gap Analysis & Scoring
Identify untested controls, real-time coverage percentages, maturity scoring
Evidence Linking
Every mapping backed by tool outputs and exploitation artifacts
Reports That Actually Communicate Risk
Every report is written by agentic AI that understands the full context - not generated from generic templates.
Report Types
Executive Summary
C-suite, board, non-technical
High-level risk overview, critical findings, business impact
Technical Report
Security teams, developers
Detailed vulnerabilities, exploitation steps, remediation code
Compliance Report
Auditors, compliance officers
Finding-to-control mappings, gap analysis, evidence references
Full Report
All stakeholders
Everything combined into one comprehensive document
What Makes Our Reports Different
- CVSS v3.1 Scoring with full vector string
- AI-written descriptions based on what it actually observed
- Exact evidence - precise commands, tools, exploitation process
- Attack chain mapping showing how vulnerabilities chain together
- Meaningful remediation with code examples and config changes
- MITRE ATT&CK mapping for every finding
- Full audit trail with timestamps
Your Data Never Leaves Your Device
Zero-cloud architecture. This isn't a privacy feature bolted on - it's the foundational design principle.
Everything Runs Locally
Why This Matters
- Regulatory Compliance
Meet data residency requirements. Nothing touches third-party servers.
- Air-Gapped Environments
Works fully offline after initial setup.
- Competitive Intelligence
Your patterns and strategies never train someone else's model.
- Client Confidentiality
If you're a consultant, client data never leaves the testing machine.
How WASA AI Compares
Cloud Scanning Platforms
(e.g. Pentest-Tools.com)
| Dimension | Competitor | WASA AI |
|---|---|---|
| AI Intelligence | ML for classification. Automation through 'robots'. Human drives strategy. | Fully agentic AI - autonomous agents that reason, plan, adapt, and make strategic decisions. AI drives - you supervise. |
| Data Privacy | Scan data, findings, network topology stored on their cloud servers. | 100% local. Nothing ever leaves your device. No cloud servers. |
| Pricing Model | Asset-based - costs scale with targets. ~A$267-445/mo. | Flat pricing - unlimited scans, unlimited targets. From A$250/mo. |
| Tool Orchestration | Manual or semi-automated. You decide tools and order. | AI-orchestrated. Agents select, sequence, configure 150+ tools autonomously. |
| Compliance | No built-in framework mapping. | 11+ frameworks with automatic finding-to-control mapping. |
| Self-Learning | Static capabilities. | Per-instance self-learning. Improves with every assessment. |
| Offline Capable | Requires internet at all times. | Fully offline after setup. Works air-gapped. |
Device-Adaptive AI
The stronger your device, the stronger the application. But every device tier delivers a complete, functional platform.
Entry-Level
Compact AI agents, focused reasoning, sequential execution. Full tool access - paced to match hardware.
Mid-Range
Balanced agents with deeper reasoning and moderate concurrency. Excellent for professional use.
High-End
Full-precision agents, extended reasoning depth, parallel execution. Premium analysis quality.
Workstation (GPU)
Maximum precision, deepest reasoning, GPU-accelerated inference. Enterprise-grade throughput.
Hardware Acceleration Auto-Detected
API & Integration
REST API
- Query & Chat
- Scan Management
- Findings CRUD
- Report Generation
- Compliance Assessments
WebSocket
- Live tool output streaming
- Finding discovery notifications
- AI response streaming
- Scan progress events
MCP Protocol
- Use WASA tools from Claude, GPT, Copilot
- Bidirectional integration
- Connect to external MCP servers
- Extend capabilities with custom tools
Security & AI Safety
Trust Boundary Enforcement
Trusted
Core system, findings database, reports
Full system access
Semi-Trusted
Network/web scanning, OSINT
Process isolation - no findings access
Sandboxed
Exploitation tools, password cracking
Full VM isolation - completely contained
AI Safety Measures
- Scope Validation Hard Gate - cannot probe until authorisation confirmed
- Rate Limiting - prevents excessive tool invocations
- Resource Bounding - agent outputs bounded to prevent exhaustion
- Credential Isolation - never logged in plaintext
- Content Filtering - PII stripped before knowledge ingestion
- Audit Logging - every agent action recorded
Plans Designed for Every Security Need
All plans include local AI, self-learning agents, unlimited chat, and device adaptation.
Free
Get a taste of AI-powered security
- Brief automated vulnerability scan
- 1 proof-of-concept demonstration
- Finding summary & severity breakdown
- Unlimited AI chat about findings
- Self-learning AI personalised to you
- Full device adaptation
Premium
Full-power penetration testing
- Full 11-phase testing, 150+ tools
- Unlimited scans & targets
- Executive + Technical reports
- All formats (HTML, PDF, JSON, MD, Excel)
- Full suite of AI agents
- Attack chain analysis
- PoC generation with evidence
- CVSS v3.1 scoring
- Real-time dashboard
Pro
For security professionals
- Everything in Premium
- Compliance reports (11+ frameworks)
- Full compliance controls & mapping
- Compliance scoring & maturity
- Custom agent creation
- Custom RAG documents
- Daily knowledge base updates
- Advanced analytics
- Priority support
Enterprise
API access & governance
- Everything in Pro
- Full REST API access
- WebSocket streaming API
- MCP Protocol support
- Complete audit logs
- Governance reports
- CI/CD integration
- JSON structured output
- Priority engineering support
Custom & White-Label
Your brand. Your tools. Your platform. Full rebrand, custom MCP tools, custom agents, volume licensing.
Frequently Asked Questions
Do I need a powerful computer?
WASA AI runs on any modern computer. The AI agents automatically detect your hardware and optimise. Stronger hardware = faster analysis and deeper reasoning - but every tier gets the full security toolset.
Does WASA AI send my data to the cloud?
No. Everything runs locally. The AI agents, knowledge base, security tools, scan data, and reports all stay on your device. No internet required after initial setup.
What operating systems are supported?
Windows, macOS, and Linux. GPU acceleration supported across NVIDIA, AMD, Intel, and Apple Silicon.
Can I use WASA AI for compliance audits?
Yes. Pro and Enterprise tiers include compliance reporting across 11+ frameworks including NIST, OWASP, ISO 27001, PCI-DSS, HIPAA, and SOC 2.
How is the self-learning different from other AI tools?
Each WASA AI instance learns independently on your device. Your agents' patterns, vulnerabilities, and strategies are never shared, uploaded, or used to improve anyone else's experience.
What happens to my data if I cancel?
Since everything is stored locally on your device, your data stays with you. Nothing to export, nothing to migrate - because we never had it.
Ready for AI-Powered Security Testing?
The firepower of a senior security team. The privacy of never leaving your machine.