Agentic hybrid DAST · a self-hosted web application security scanner

Modules attack. The agent adapts. Proof decides.

Deterministic modules do the testing. An agent loop decides what to try next when a rule runs out of ideas. Nothing reaches the report until the engine reproduces it.

Join the launch list See how it works

Runs on your Windows or Linux hostAI optional, off by defaultOne flat plan, published price

scan 2841 · app.example.internal

Run

Crawl · 412 routes
Recon · 3 services
Attack · module 14 of 21
Confirm · 2 queued
Report · waiting

passed the gate waiting for evidence refuted, keptfirewall recognized · 6 evasion techniques selected

SeverityFindingRouteVerification gate

Critical Database injection GET /api/orders?id= Exploited

High Client-side script execution POST /profile/bio Confirmed

High Access control · object level GET /export/{tenant} Confirmed

Medium Origin reflected · credentials OPTIONS /api/session Possible

Low Token reuse after logout GET /api/session Refuted

Evidence · database injection Exploitedenginetiming differential 2.9 s vs 112 ms median baseline, 3 of 3 repeatsconfirmtrue/false probes answered consistently, 12 of 12impactdatabase version and current user read through the confirmed pointprovenanceproposed by agent · executed and reproduced by engine

$ confirm › browser dialog fired → promoted to Confirmed

21 Active vulnerability modules, plus 10 passive analyzersmodule list · release-pinned

19 Database engines fingerprinted with per-engine techniquesengine list · release-pinned

51 Weakness classes (CWEs) covered by the active and passive modulesCWE map · release-pinned

Local Core scan processing and the findings database stay on your host127.0.0.1 · Windows or Linux · nothing uploaded

Reports in the standards your tools already readCVSS 4.0CISA KEVEPSSSSVCSARIF 2.1.0MITRE ATT&CK Navigator

How hybrid agentic scanning works

Two ways of thinking about a target. One standard of proof.

SelfSec pairs a deterministic scan engine — crawler, injection modules, WAF evasion, confirmation workers — with an LLM agent that plans the next experiment when a rule runs out of ideas. Every candidate the agent raises must be reproduced by the engine before it reaches the report, and the whole thing runs on your own machine.

Orchestrator

Agent · plans

propose module sweepafter a stalled check on /api/orders

propose response comparetwo sessions, one object id

propose evasion mutationwaits for your approval

the agent never sends a request · the engine executes what it proposes

Engine · executes

single probemodule sweepevasion mutationintruder runresponse compare

targetapp.example.internal

Gate · decides

real browser dialog

timing differential vs baseline

out-of-band callback from the target

verification gate · opens only for reproduced evidence Confirmed no evidence → back to the agent, next round

01 · Deterministic engine
Hardcoded modules do the testing

Fixed payload sets, a SQL injection engine with per-database techniques, a Chromium crawler that keeps authenticated state, and a WAF evasion chain composed per target. Every request is repeatable and every verdict is auditable.
crawl → attack → observe · the same engine, with or without a model
02 · Agent loop
The model plans the next experiment

When a deterministic check stalls, the model is handed the real crawl data and findings, proposes the next experiment, watches the result and plans again — inside a turn cap and a per-run budget. It never sends a request itself; the engine executes what it proposes.
dangerous actions wait for your approval · suggest or autonomous mode, your choice
03 · Verification gate
The engine decides what is real

Model text never confirms anything. A candidate the agent reports is recorded as Possible and handed to the same confirmation workers as every other finding. The model can nudge a confidence score only inside a narrow band, and it keeps no memory between scans.
no alert() → not Confirmed · no reproduction → not Confirmed, however good the proposal looked

AI is optional and off by default. Turn it on with your own Anthropic or OpenAI key, keep it on your host with Ollama, or use the hosted AI included in the plan. Whether it finds more than the deterministic engine alone is a question for your own targets, not a claim this page makes.

Finding lifecycle

Confirmation is a stage, not an adjective

Most scanners hand you a severity and leave the verification to you. Here a finding carries the stage it has actually earned, and the engine is the thing that promotes it.

○ Possible detection rule matched · raw request, response and baseline recorded● Confirmed a second, different kind of evidence agreed◆ Exploited impact demonstrated by the engineFinding A · High PossibleConfirmedExploited raw request + response + baselinereal browser dialog firedtiming differential survived baselinedata read through the confirmed point

Finding A · HighPossible raw request + response + baselineFinding AConfirmed real browser dialog firedtiming differential survived baselineFinding AExploited data read through the confirmed point

Finding B · Low Refuted kept with its evidence, not silently dropped no callback received differential within baseline

Possible

A detection rule matched. The finding is recorded with its raw request, the response and the baseline it was compared against — and it stops here until something independent agrees.

Confirmed

A second, different kind of evidence agreed: a real browser dialog, a timing differential that survives a median-and-standard-deviation baseline, or an out-of-band callback from the target itself.

Exploited

The engine went further and demonstrated impact — extracted data through a confirmed injection point, or reached a resource the access-control check said it should not.

A client-side script finding is only Confirmed when a real dialog fires in a Chromium page the scanner is driving.

The depth behind the workflow

Every capability is a stage of the same engine

See how it works, category by category

01
Reach the real attack surface

Render modern applications, survive two-factor login walls and turn newly discovered routes into attack targets while the crawl is still running.

Crawl A crawler that renders like a human, not a bot Auth Two-factor logins are a configuration, not a blocker Mobile Android apps feed the same engine, not a second product
02
Prove it before you report it

A finding starts as Possible and only becomes Confirmed when independent evidence says so — a dialog that actually fired, a timing differential that survives its baseline, a callback from the target's own infrastructure.

Attack An attack engine that thinks, not a checklist Agent AI that plans the attack, the engine that confirms it Confirm The stage a finding earns, not the one it claims WAF evasion Tests through the firewall you actually run · 71 vendors recognized
03
Know what to fix first

Every CVE-bearing finding carries a CVSS 4.0 vector, whether CISA lists it as known-exploited, its EPSS exploitation probability and an SSVC decision — so the queue orders itself.

Reporting Triage and reporting that ships Self-host Core scan processing stays on your machine

Your infrastructure

Know where every security-sensitive flow goes

Data boundary · local core · explicit remote flows

■ Your hostcrawler & browser sessionattack engine & evasion chainresponses & evidencefindings databasenever uploadedHTML · JSON · SARIF · Markdown · ATT&CKlocal model via Ollamaoptional

◇ selfsec.ioaccount & subscriptionsign-in, no license keysdevice checkwhich device, which plancallback relay for out-of-band checkstiming metadata only, never callback contents

▲ configured AI service your Anthropic or OpenAI key, or the plan's hosted AI · receives the scan context the work needs · optional, off by default

targets, responses and findings never cross this line

Targets, responses and findings remain with the scanner. Activation is narrowly scoped: which device holds which plan, and nothing else. Claims on this site are checkable by design:

Every number is pinned to a scanner release

21 modules, 19 database engines, 51 CWEs: each count comes from the scanner's own lists at a named release, and each number links to the list it was read from.
Comparisons are sourced and dated

Every competitor cell quotes the vendor's own page with a link and the date it was checked; SelfSec's own cells link to the page that states the fact. Stale evidence is removed, not left standing.
We run our own defenses on ourselves

selfsec.io sits behind the same kind of firewall the scanner is built to test through.
No analytics, no tracking

This site uses no advertising or third-party analytics. What you read here stays between you and the page.

Who builds SelfSec System requirements Report a vulnerability

SelfSec DAST · one plan Launch price

Flat pricing. Everything included.

$250 / month

Unlimited targets and scans
Up to 5 devices · no per-user fees; release a device from your dashboard any time
Every module · 21 active and 10 passive, nothing held back for a higher tier
Hosted AI included · or bring your own Anthropic or OpenAI key, or run Ollama on your host
Every export · HTML, JSON, Markdown, SARIF 2.1.0, ATT&CK Navigator

Join the launch list

Nothing is charged during pre-release; this is the launch price. USD, excl. VAT, billed monthly. SelfSec is sold to businesses and self-employed professionals only.

How SelfSec compares

Product model, deployment and buying path, in each vendor's own words

Acunetix is now sold as Invicti Web + API; the two right-hand columns describe one vendor's two products.

How SelfSec compares: product model, deployment and buying path, in each vendor's own published words. Checked 2026-10-03.
Axis	SelfSec	Burp Suite Pro	Invicti	Invicti Web + APIformerly Acunetix
Buying basis	One flat plan at a published launch price, up to five devices. Nothing is charged during pre-release. Sold to businesses and self-employed professionals only.S	$4991 · Licensed for individual users.	Start a quote2 · on every tier; the only published figure is "$500 max per pentest"	Get a quote3 · A target is defined in Invicti as a fully qualified domain name (FQDN).
Deployment	Runs on 127.0.0.1 on a Windows or Linux host you control.S	Local installation only.4	SaaS, on-prem, and hybrid options5 · the pricing page lists "On-Premises (coming soon)" for Web + API	deploy Invicti on premises or as a SaaS solution6 · the pricing page lists "On-Premises (coming soon)"
Validation approach	A finding stays Possible until independent evidence promotes it to Confirmed; Exploited only when impact is demonstrated; Refuted findings are kept with their evidence.S	Not stated on page7	Proven exploitability. Zero guesswork.5	automated proof of exploit for many findings6
AI role	Optional and off by default. The agent proposes the next experiment; the engine runs it and decides. Your own Anthropic or OpenAI key, Ollama on your host, or the plan's hosted AI.S	AI assistance that helps you move faster through validation, exploration, and repetitive tasks, while keeping you in control.8	Meet Octo, the hybrid agentic pentester combining scanners and AI9	World's best DAST, even better with AI10
Trial path	Join the launch list. Today the app runs only with an active plan. Launch evaluation terms are being decided and will be stated on this row before public downloads open.S	Try Burp Suite Professional for free8	proof-of-concept licenses so you can evaluate the platform2	no-risk Proof of Concept licenses3
Exports and CI	HTML, JSON, Markdown, SARIF 2.1.0 and a MITRE ATT&CK Navigator layer, driven by a local HTTP API. A packaged command-line runner is on the roadmap.S	Simple reporting with automated report generation7 · formats: not stated on page	110+ out-of-the-box integrations plus a powerful API and open-source CLI5 · formats: not stated on page	Integration with CI/CD pipelines6 · formats: not stated on page
Data boundary	Targets, responses and the findings database stay on the scanner host. Activation sends only the device identifier and your plan; the product reports no diagnostics; a configured AI service receives the scan context the work needs.S	Automatically keep a persistent log of all your testing activities using project files7 · where data is processed: not stated on page	Not stated on page2 · hosting regions are published; which data leaves your environment is not	Not stated on page6
Team model	Up to five devices under one flat price, no per-user fees. Unlimited targets and scans.S	Designed for use by individual testers.4	Unlimited users and scans5	supports both small teams and enterprise security programs6
Product model	Hybrid agentic vulnerability scanner (DAST) that runs as a self-hosted local service. Pre-release.S	The world's #1 web penetration testing toolkit.8	Complete AppSec in one platform.11	Acunetix is now Invicti Web + API.10

Sources · checked 2026-10-03

“S” markers link to the SelfSec page that states the fact. This compares product models and buying paths, not detection results. Quoted text is copied from the linked page as it read on the checked date. “Not stated on page” means the linked page does not say; it does not mean the product lacks it. Vendor offerings and prices change; follow each source before purchasing.

Sources (11)

From the blog

Understand the findings before you read the report

All posts

Server-side requests & parsers <!ENTITY lol9 "&lol8;&lol8;&lol8;">

XML External Entity5 min read

Billion Laughs: Denial of Service Through XML Entity Expansion

An XML parser that expands internal entities will happily inflate a few hundred bytes into gigabytes of memory. Here is how the billion-laughs bomb and its quadratic-blowup cousin DoS a server with no network and no external DTD, and the parser limits that stop it.

Client-side & redirects new Image().src='//attacker.example/x'

Cross-Site Scripting5 min read

Blind XSS: When Your Payload Fires in an Admin Panel You Never See

Blind XSS stores a payload that executes later in a context the attacker never sees — an admin dashboard, a log viewer, a support back-office. Here is how it surfaces, why an out-of-band callback is the only way to confirm it, and how the same stored-XSS defenses shut it down.

Files, objects & APIs { user(id: 1043) { email } }

GraphQL5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

Launch list

Be first to run SelfSec

Join the launch list to hear when public downloads open, with deployment guidance and the first production-ready release. Nothing is charged during pre-release.