hire an ai
that thinks
like an attacker.
Impactr is an AI that pentests your web apps and APIs the way a senior offensive security engineer would - investigating, chaining vulnerabilities, and proving impact with evidence. No more vulnerability scanners producing PDFs of noise.
- Read-only by default
- No agents to install
- Evidence with every finding
Kill Chain
Architecture Pivot
Tests mapped to the frameworks your auditors already trust
from internal testing on pre-launch benchmark targets
the problem
You don't have a scanning problem. You have an investigation problem.
Scanners flag, they don't investigate
Traditional DAST tools pattern-match against known signatures and hand you a list of maybes. Triage takes longer than the scan.
Real vulnerabilities live in the chain
The IDOR that leaks a tenant ID. The auth flaw that unlocks it. The logic bug that turns it into account takeover. Scanners see none of it - they check boxes, not paths.
Manual pentests happen twice a year
Your app ships fifty times before your next scheduled pentest even starts. The gap between releases and review is where breaches live.
the approach
Built to reason about your application, not just crawl it.
It investigates
Impactr explores your app the way a human tester would - following redirects, testing role boundaries, probing every parameter it finds along the way.
It chains
Individually low-severity findings get combined into real attack paths: an information leak revealing an IDOR, which leads to account takeover.
It proves impact
Every finding ships with a reproducible proof of concept - the request, the response, and the exact steps a developer needs to fix it.
how it works
From URL to confirmed attack path.
Point it at your app
Give Impactr a URL, an API spec, or a set of authenticated roles. No agents to install, no code changes required.
It maps and investigates
Impactr builds a live model of your attack surface - endpoints, roles, data flows - and starts probing for weaknesses the way a human would.
It chains what it finds
Individual findings are tested together for exploitable paths, not reported in isolation. If three low-severity issues chain into one critical one, you'll see the chain.
You get evidence, not a wall of text
Every confirmed finding includes a reproducible PoC, the exact request/response pair, and a fix recommendation your team can act on same-day.
the engine
Not one scanner. A coordinated team of agents.
Impactr maps your surface, plans an approach, and runs many specialized agents in parallel - the way a real offensive team operates, at machine speed.
Attack-surface mapping
Impactr builds a live model of your endpoints, roles, parameters, and data flows - the ground truth everything else reasons about.
The coordinator
A planner decides what's worth testing and in what order, prioritizing the paths most likely to lead to real impact.
Agents in parallel
Many specialized agents probe, exploit, and pivot at once - then compare notes to chain individual findings into full attack paths.
Exploit validation
Nothing is reported until an agent demonstrates real, reproducible impact. Unproven leads are dropped, not padded into the report.
The case file
You get the chain, the working exploit, the full decision log, and a same-day fix - nothing hidden behind a severity score.
the evidence
This is what a finding looks like. Not a PDF of maybes.
Every confirmed finding ships with the chain that produced it, a request you can replay yourself, and a fix your team can act on the same day.
Account takeover via IDOR chained through a JWT audience mismatch
POST /api/v2/accounts/{id}/session
Impact
A tenant-scoped access token is accepted on a sibling tenant's endpoint because the audience claim is never validated. Combined with a predictable account ID, any authenticated user can mint a valid session for an arbitrary account.
Confirmed chain
- 1Enumerate account IDs from sequential invoice URLs
- 2Observe aud claim in JWT is not enforced server-side
- 3Replay own token against victim account's session endpoint
- 4Receive a fully privileged session cookie for the victim
Remediation
Validate the aud and sub claims against the requested account on every session-issuing route, and reject tokens whose subject does not own the target resource. Add an authorization test that replays a tenant A token against a tenant B object.
POST /api/v2/accounts/48213/session HTTP/2Host: api.acme-demo.ioAuthorization: Bearer eyJhbGciOiJSUzI1Ni…Content-Type: application/json{ "scope": "session:create" }# token issued for account 91077, not 48213
HTTP/2 200 OKSet-Cookie: sid=8f2c…; HttpOnly; Secure{"account_id": 48213,"role": "owner","session": "active"}
proof
We don't ask you to trust the score. We show the exploit.
Confidence in a finding should come from a working exploit, not a label. Three principles keep every Impactr result honest:
Exploited, not inferred
A finding only reaches your report once an agent reproduces it end-to-end with a working proof of concept. If impact can't be demonstrated, it's dropped - never padded in behind a severity score.
Measured against ground truth
Impactr is evaluated on a benchmark of realistic scenarios with known-good answers, so its true- and false-positive rates are measured, not assumed - and every regression is caught.
Re-proven on every change
After a fix ships, the exact chain is replayed to confirm the path is closed. If it isn't, the finding reopens automatically - proof that stays true as your code moves.
Benchmarked on internal, pre-launch scenarios modeled on real-world app architectures. We'll publish full results as the program matures - no borrowed leaderboards, just reproducible evidence.
capabilities
Everything a senior pentester does. None of the scheduling.
AI investigation
Explores your app dynamically instead of matching static signatures.
Attack chain discovery
Combines individually minor findings into confirmed, exploitable paths.
Developer-ready reports
Findings written for the engineer who has to fix them, not just an auditor.
Evidence collection
Every finding ships with request/response pairs and a working PoC.
Continuous testing
Re-runs on every deploy so new code gets tested before attackers find it.
API understanding
Parses OpenAPI/GraphQL schemas to test business logic, not just endpoints.
Context-aware analysis
Understands auth roles and tenant boundaries to find access-control flaws.
False positive reduction
Every finding is actively validated before it's reported - not just flagged.
coverage
The vulnerability classes that actually get you breached.
Impactr tests for the flaws that lead to real compromise - and, more importantly, the ways they chain together. A representative slice:
Access control & authorization
- IDOR
- BOLA
- BFLA
- Privilege escalation
- Tenant isolation
- Mass assignment
Authentication & sessions
- JWT forgery
- OAuth flow abuse
- MFA bypass
- Session fixation
- Auth rate-limit bypass
Injection & RCE
- SQL / NoSQL injection
- SSTI
- Command injection
- XXE
- Insecure deserialization
Server-side & infrastructure
- SSRF
- DNS rebinding
- Cloud metadata (IMDS)
- Path traversal
- Open redirect
API & protocol logic
- GraphQL introspection abuse
- Batching attacks
- REST business logic
- Race conditions
- Rate-limit bypass
Client-side
- Reflected / stored / DOM XSS
- CSRF
- CORS misconfiguration
- Clickjacking
- Prototype pollution
Coverage expands continuously as new techniques and CVEs land - no rule packs to update.
why not just-
Scanners are fast. Manual pentests are thorough. Rarely both.
| DAST scanner | Manual pentest | Impactr | |
|---|---|---|---|
| Finds known CVEs / signatures | |||
| Chains findings into real attack paths | |||
| Reasons about business logic | |||
| Provides reproducible evidence | |||
| Runs on every deploy | |||
| Available in days, not months | |||
| Low false-positive rate |
use cases
One engine, wherever security testing needs to happen.
Continuous testing in CI/CD
Run Impactr on every merge and deploy. Shift security testing left so new code is exercised before it reaches production - not two quarters later.
Pre-release security gate
Block a launch on confirmed, exploitable findings instead of a scanner's list of maybes. Ship with a clear read on what an attacker could actually do.
API & microservice security
Point it at a REST or GraphQL surface, with or without a spec. Impactr tests business logic and access control across services, not just single endpoints.
Post-incident & regression validation
After a fix ships, prove the attack path is closed - and stays closed. Impactr re-runs the exact chain and confirms the exploit no longer works.
Audit & compliance evidence
Produce reproducible, evidence-backed findings for SOC 2, ISO 27001, and PCI DSS reviews - the kind of proof auditors and boards accept.
Vendor & M&A assessment
Get an attacker's-eye read on an acquisition target or third-party app in days, not the months a manual engagement takes to schedule and run.
control & compliance
Aggressive testing. Enterprise-grade control.
An autonomous attacker on your side has to earn trust. Impactr is scoped, logged, and auditable by design - and its evidence is built to satisfy the reviews you already answer to.
Read-only by default
Impactr tests over HTTP like an external attacker. Destructive actions are gated and opt-in, per target.
Scoped to your targets
It only tests the hosts, endpoints, and roles you authorize - nothing outside the scope you define.
Fully logged & auditable
Every request, decision, and finding is recorded. Hand an auditor the complete trail, not a summary.
Your data stays yours
Deployment options keep testing and evidence inside your environment, with isolation controls for regulated teams.
Produces evidence for
early access
What early access users are finding.
“We ran it against an API we thought we knew well. It found an auth chain three of our engineers had missed in review.”
“The report read like something our own pentest vendor would write - not a scanner dump we had to triage for two days.”
“What sold us was the evidence. Every finding came with a request we could replay ourselves.”
faq
Questions,
answered directly.
Scanners match traffic against known signatures and report every possible match, leaving you to triage. Impactr investigates the way a person would: it follows leads, tests role and tenant boundaries, and chains individually low-severity findings into confirmed attack paths - then proves exploitability before reporting anything.
Think of it as what happens between your scheduled pentests. Impactr runs continuously as you ship, so the gap between releases and review - where most real-world exploitation happens - gets covered. Many teams will use both.
Impactr is built for web applications and APIs - REST and GraphQL, with or without an OpenAPI spec. Give it a URL or a spec and a set of authenticated roles to test against.
No. Impactr tests your application the way an external attacker would - over HTTP, using credentials you provide for the roles you want covered.
Every finding is actively validated, not just flagged. If Impactr can't demonstrate real impact with reproducible evidence, it doesn't make it into your report.
We're onboarding early access users in small batches so every team gets real attention during setup. Join the waitlist and we'll reach out with next steps.
get access
Find out what your scanner is missing.
Join the waitlist to get early access as we onboard new users.