Features

Attack Surface

Overview

Your attack surface is a living map of everything an attacker could reach in a workspace: the applications you run, the endpoints they expose, and the context that helps agents reason about each one. Pensar builds and maintains this map automatically, then uses it to scope and steer every pentest.

The attack surface is guidance, not findings. The business logic, threat models, and pentest objectives attached to each endpoint are AI-drafted context that steers how the pentest agent tests — they are not confirmed vulnerabilities. Confirmed, verified findings only appear as issues after a pentest runs.

How It Works

Pensar discovers and maps your attack surface through reconnaissance. The approach depends on whether you’ve provided source code access:

When you provide source code (via VCS integration or zip upload), Pensar’s AI agents perform static analysis to identify:

  • Web Routes & Endpoints: All HTTP endpoints, REST APIs, GraphQL schemas, and WebSocket connections
  • Authentication Mechanisms: Login pages, OAuth flows, API key validation, and session management
  • Input Vectors: Forms, query parameters, request bodies, headers, and file uploads
  • External Dependencies: Third-party APIs, external services, and integrations
  • Data Flows: How data moves through your application and where it’s processed or stored

Source code analysis provides the most comprehensive attack surface mapping with detailed understanding of application internals.

What Each Endpoint Holds

Open any endpoint in the Attack Surface view to see the context Pensar has assembled for it. Recon drafts each section; you can edit any of it inline to sharpen what agents reason about.

Everything below is soft guidance for the testing agent — a starting point recon inferred about the endpoint, not a statement that the endpoint is vulnerable. Treat it as the brief you’d hand a human pentester, and refine it to point testing where it matters most.

The endpoint’s metadata — its type, whether authentication is required, where it lives in the source, and a calculated risk score with its breakdown. All editable inline.

What the endpoint actually does — its purpose, the actors involved, the data that flows through it, and the invariants and trust boundaries it must uphold. This helps agents understand intended behavior so they can spot deviations from it.

The adversaries worth worrying about, the attack vectors they’d use, and the controls already in place. Refine it to focus testing on the threats that matter most for this endpoint.

Concrete, falsifiable hypotheses an agent will try to prove during a pentest. Objectives are the single biggest lever you have over what gets tested — add, edit, or remove them to focus effort on high-value endpoints.

Pentest Objectives

For each identified endpoint, Pensar automatically generates pentest objectives — specific, falsifiable testing goals that guide how that endpoint should be tested. They describe what an agent will attempt to prove, not what it has already found.

OWASP Top 10 and OWASP API Top 10 coverage is applied by default. Every pentest automatically tests for the full set of OWASP Top 10 and OWASP API Top 10 security risks — no configuration required. Objectives let you extend and focus testing with additional, targeted goals specific to your application.

What Are Pentest Objectives?

Pentest objectives are AI-generated testing strategies tailored to each unique endpoint based on:

  • The endpoint’s functionality and purpose
  • Input parameters and their types
  • Authentication and authorization requirements
  • Potential security risks specific to that endpoint

Example Objectives

For a /api/auth/login endpoint, objectives might include:

  • Test for SQL injection in username/password fields
  • Verify rate limiting on failed login attempts
  • Check for username enumeration vulnerabilities
  • Test session token generation for randomness
  • Verify secure password storage mechanisms
  • Test for authentication bypass vulnerabilities

For a /api/files/upload endpoint, objectives might include:

  • Test file type validation and extension filtering
  • Verify file size limits are enforced
  • Check for path traversal vulnerabilities
  • Test for malicious file content detection
  • Verify uploaded files cannot be executed
  • Test for unrestricted file upload vulnerabilities

For a /api/users/:id endpoint, objectives might include:

  • Test for Insecure Direct Object Reference (IDOR)
  • Verify authorization checks for other users’ data
  • Test for SQL injection in ID parameter
  • Check for sensitive data exposure in responses
  • Test mass assignment vulnerabilities
  • Verify input validation on profile updates

Workspace Objectives

While Pensar covers the OWASP Top 10 and OWASP API Top 10 by default, you can define workspace objectives to extend pentesting with additional, targeted testing goals. These are useful when your application has domain-specific security concerns that go beyond standard vulnerability categories — compliance requirements, business logic testing, known risk areas, or custom integrations.

Navigate to Settings > Agent Configuration > Context and open the Objectives tab to add custom objectives. They are automatically included when generating attack surfaces for all applications in the workspace, and can be propagated to existing endpoints.

See the Workspace Objectives page for detailed guidance on writing effective objectives, propagation, and example objective sets for common application types.

Attack Surface Visualization

Once mapping is complete, you can view your entire attack surface in the Pensar Console:

1

Endpoint Inventory

Browse all discovered endpoints with details about HTTP methods, parameters, and authentication requirements.

2

Testing Coverage

View which endpoints have been tested, are currently being tested, or are queued for testing.

3

Risk Assessment

See automatically calculated risk scores for each endpoint based on functionality and exposure.

4

Testing Progress

Monitor real-time progress as the AI agent works through pentest objectives for each endpoint.

Continuous Mapping

Mapping your attack surface isn’t a one-time activity:

Pensar automatically updates your attack surface map when:

  • New code is pushed to your repository
  • New domains are added to your workspace
  • Reconnaissance discovers new subdomains or endpoints
  • Application routes or APIs are modified

This ensures your security testing always covers your current application state, not just a point-in-time snapshot.

Benefits of a Comprehensive Attack Surface

Complete Coverage

Ensure no endpoints are missed during security testing. Automated mapping finds endpoints that manual testing often overlooks.

Targeted Testing

Per-endpoint guidance and objectives ensure each endpoint is tested with relevant security checks rather than generic scans.

Faster Results

Automated mapping is faster and more thorough than manual reconnaissance, reducing time to first findings.

Better Context

Source code analysis provides context about business logic that makes vulnerability detection more accurate.

Next Steps

With your attack surface mapped, Pensar moves on to penetration testing:

  • Hybrid Testing: Learn about Pensar’s hybrid testing methodology combining source analysis with live exploitation
  • View Results: Monitor testing progress and review confirmed findings in real-time through the Console dashboard