Proof of exploit · authorized pentest

Scanners guess what's exploitable. BreachLens proves it or drops it.

Each candidate finding is put through controlled exploitation against your authorized target, in an isolated browser, recorded. It only earns the CONFIRMED badge when it actually reproduces — and it ships with a reproducible command and a replay you can watch.

Book a technical demo Read the docs

Runs on your infrastructureNothing leaves your networkYou mark what's in scope

breachlens · pentest

Proof, not alerts

A finding you can't reproduce is a guess.

Every other scanner ends at a ranked list, and your team spends the week arguing which entries are real. BreachLens ends at evidence — so the debate is about the fix, not whether the bug exists.

Detected

A scanner flags a candidate

A scanner surfaces a possible issue in code, a container, cloud config, or a running app.

Attempted

Controlled exploitation

BreachLens tries to exploit it against your authorized target, in an isolated browser — and records exactly what happens.

Confirmed

Evidence attached

If it works, the finding ships with a reproducible command, the evidence URL, and a replay. If it doesn't, it's labelled honestly by confidence.

What you get

Evidence a security team can act on — and an auditor will accept.

Proof of exploit

A reproducible command, not a score.

· A runnable command that replays the attack end to end.
· The evidence URL and the exact request that worked.
· Run it yourself against a lab target and watch it fire.

Recorded replay

Watch the exploit happen.

· Exploitation runs in an isolated browser and is recorded.
· A short replay is attached to every CONFIRMED finding — a video, not just written steps.
· Record an authenticated journey so testing drives the flows that matter.

AI-augmented — on your own model

The attacker's brain is one you own.

· AI generates exploitation payloads tuned to your application's context.
· It runs on your own model — Anthropic, OpenAI, Gemini, or fully local.
· No vendor's AI ever touches your systems, and the proof never leaves your network.

Function-level reachability

Is the vulnerable code actually reached?

· Traces the call path from entry point to the vulnerable function.
· Across major language ecosystems.
· De-prioritises what can't be reached, so you fix what's real first.

Kills false positives

CONFIRMED means reproduced.

· Only findings BreachLens actually exploited are marked CONFIRMED.
· Everything else is labelled by confidence — plainly, no inflation.
· Fewer tickets, and a signal your team and your auditors trust.

breachlens · pentest

The evidence behind a confirmed BreachLens exploit — the affected URL, the vulnerable parameter, the payload that worked, and the HTTP response it returned.

The evidence behind the badge — the affected URL, the vulnerable parameter, and the payload that worked. Enough to reproduce it yourself.

Straight answers

The questions a security team asks about pentest access.

Is the “proof of exploit” real, or a dressed-up severity score?

Real. A finding is only marked CONFIRMED when BreachLens actually reproduced the exploit against your authorized target. The evidence includes a runnable command and the evidence URL — you can run it yourself and watch it work. It is not a heuristic confidence number.

Is it safe to grant authenticated / pentest access?

Straight answer: authenticated scan and pentest access is operator-trust — gated by an explicit authorized/controlled flag, RBAC, and license tier, not a cryptographic ownership proof. Exploitation only runs against targets you mark authorized, on infrastructure you host. We'd rather state the limit plainly than let you find it during an eval.

Where does the exploitation actually run?

On your infrastructure. BreachLens stands up the isolated browser inside your own deployment; nothing about the target, the evidence, or the replay leaves your network. It can run fully air-gapped.

Isn't “AI pentesting” just a vendor's AI poking at my systems?

Not here. BreachLens is AI-augmented — it generates context-aware exploitation payloads for your stack — but it runs on your own model and your own infrastructure. The AI doing the attacking is one you control, and the proof (the runnable command and the recorded replay) never leaves your network. That's the difference between an AI pentester you run and one you rent.

Does it re-test continuously?

Honest answer: today it runs when you trigger it — from CI, a schedule you set, or on demand. Continuous re-validation is on the roadmap, not shipped — we won't imply it's live.