Reflectiz Bets on Agentic Pentesting, but the Real Fight Is Over What "Coverage" Means

Reflectiz has stepped into one of the most crowded corners of AI security: automated offensive testing for web applications. The company is positioning its new platform as an agentic pentesting system, built around multiple specialized AI agents that discover, attack, and validate web vulnerabilities. The headline claim is aggressive - up to 10x coverage compared with conventional pentests - but the security significance depends on how that coverage is defined, measured, and audited.

Fast Facts

• Reflectiz launched a multi-agent pentesting platform for websites.
• The system is described as using specialized AI agents to discover, attack, and validate vulnerabilities.
• The company is claiming up to 10x coverage versus conventional pentests.
• The launch sits inside a broader shift toward continuous web exposure management.
• The main technical question is whether the platform measures breadth, depth, or both.

What the launch really changes

From a defensive perspective, the interesting part is not the marketing label "agentic." It is the operational model behind it. Traditional web pentests are usually scoped engagements: a human tester works through a defined target set, with limited time and a finite number of workflows to inspect. A multi-agent system can, in theory, partition that work across roles - mapping, attack execution, and validation - and repeat it more often than a human-led engagement.

That matters because modern web risk is still dominated by familiar failure modes: broken access control, authentication mistakes, injection paths, and misconfiguration. Automated agents do not create a new vulnerability class. They may, however, make it easier to revisit the same classes more frequently across more pages, more roles, and more session states.

The hard problem is trust. If a vendor says "coverage," does that mean endpoints tested, workflows exercised, roles simulated, or findings validated? Those are very different metrics. A platform can look broad on paper while still missing complex business logic, unusual authorization paths, or corner-case behaviors that only appear under specific user states.

That is why the most important control is not the AI label itself, but the audit trail. Security teams need to know what was tested, what was skipped, which findings were independently validated, and whether the system can explain its path through authenticated flows. Without that, more automation can produce more output without producing more assurance.

At the time of writing, public information does not fully establish the benchmark method behind the 10x claim or the exact unit of "coverage." The available information supports a risk analysis, not a definitive verdict on comparative performance.

Conclusion

Agentic pentesting is part of a real industry shift: security testing is moving toward continuous, machine-assisted verification of live web surfaces. But the lesson for defenders is simple. Faster testing is not automatically better testing. The organizations that benefit most will be the ones that demand measurable coverage, human review for serious findings, and a clear map from AI output to real security requirements.

TECHCROOK

hardware security key: A hardware security key is a simple, portable device for adding phishing-resistant multi-factor authentication to web accounts and admin panels. It is especially useful for teams that manage sensitive dashboards, testing tools, or privileged access across multiple systems.

Scheda Techcrook: hardware security key

WIKICROOK

• Agentic pentesting: Automated security testing that uses AI-driven agents to carry out different parts of a pentest workflow.
• Broken access control: A flaw where users can reach data or actions that should be restricted.
• Coverage: In testing, the amount of application surface, workflows, or attack paths actually exercised.
• Session state: The data that keeps a web interaction tied to one logged-in user or workflow.
• Validation: The step where a finding is checked to reduce false positives before it is reported.