TL;DR
The agent stack it ships with isn't a single AI assistant - it's a coordinated system of purpose-built offensive security specialists, each with defined tools, permissions, and methodology scope, all sharing workspace memory and capable of running in parallel. Agent Capability Web Pentest Agent Browser automation via Playwright, code execution, full OWASP WSTG coverage.
Most AI pentesting tools are wrappers. A language model in front of a scanner, a chatbot that generates nmap commands, or a dashboard that aggregates output from existing tools and calls it "AI-powered." None of that changes the underlying constraint: one tool, one target, one session at a time.
Strobes AI takes a different architectural bet. The agent stack it ships with isn't a single AI assistant - it's a coordinated system of purpose-built offensive security specialists, each with defined tools, permissions, and methodology scope, all sharing workspace memory and capable of running in parallel. This post breaks down exactly what that stack looks like, how it works, and why the architecture matters for teams running continuous exposure management programs.
Strobes is an exposure management platform for managing vulnerabilities, assets, and security workflows from a unified interface. At its core, the Agents module is where the AI capabilities are fully realized. Each agent is a purpose-built specialist - not a general-purpose assistant repurposed for security tasks. They ship with predefined tools, execution scopes, and methodology coverage that maps to real offensive security disciplines.
The platform ships with over a dozen system agents and supports custom agent creation through Agent Templates. System agents are available immediately and cover the full offensive security spectrum: from threat intelligence enrichment and vulnerability triage through to active penetration testing and compliance reporting. If your existing workflow covers agentic pentesting, the agents here are the engine underneath that capability.
The table below maps each built-in agent to its capability set. These are not marketing descriptions - each agent has specific tool access, execution environments, and methodology coverage that determines what it can and cannot do.
| Agent | Capability |
|---|---|
| Web Pentest Agent | Browser automation via Playwright, code execution, full OWASP WSTG coverage |
| Network Pentest Agent | Shell execution via workspace SSH, nmap, service enumeration, multi-host parallel testing |
| API Pentest Agent | REST and GraphQL testing with Python requests, httpx, and curl |
| Login & Auth Agent | Handles OTP, SSO, social login, email/password, CAPTCHA, MFA - produces reusable login scripts |
| Breach Simulation Agent | Safe, non-destructive exploitation validation to confirm true positives versus false positives |
| Attack Path Analyzer | Graph-algorithm analysis of asset relationships to find paths from external entry points to crown jewels |
| Code Review Agent | Autonomous source code analysis, SAST verification, vulnerability reachability |
| Code Reachability Analyzer | Builds call graphs to determine if SCA and SAST findings are actually exploitable |
| Exposure Assessment Agent | Cloud API, DNS probing, WAF and CDN detection for business sensitivity scoring |
| Threat Intel Agent | CVE, KEV, and exploit intelligence enrichment from threat feeds |
| AWS Agent | AWS CLI and boto3 for cloud reconnaissance, IAM, S3, EC2, and RDS assessment |
| Mobilization Agent | AWS tag and git history owner lookup, GitHub issue creation for finding assignment |
The coverage here matters. A finding discovered by the Web Pentest Agent isn't siloed. It can be handed immediately to the Breach Simulation Agent for exploitation validation, then to the Threat Intel Agent for CVE enrichment, then to the Mobilization Agent for owner identification and ticket creation - all within the same workspace, without a human manually copying context between tools.
One of the more architecturally significant decisions in Strobes AI is the Skills system. Skills are modular, versioned instruction sets that extend what agents know how to do - following the open SKILL.md standard. They can be scoped per workspace, created via a natural-language Skill Generator, or uploaded as raw SKILL.md files.
This is not prompt engineering. A Skill defines a methodology: tools to use, phases to execute, what to record, and what constitutes a valid finding. The platform ships with active skills covering:
The ability to define and attach custom skills to specific workspaces means the platform can be extended without code changes. A red team engagement against a financial services target with specific OAuth flows can have a custom skill that encodes exactly the testing methodology for that environment.
Autonomous pentesting raises a real governance question: what happens when an agent wants to exploit a finding, send a request to a live system, or create a ticket in your Jira? Strobes AI answers this with a structured Human in the Loop (HITL) system.
HITL can be toggled per conversation using the APPROVALS switch in the chat interface. When enabled, agent actions require explicit approval before execution - creating a full audit trail and gating sensitive operations like finding creation, status changes, or external integrations. The platform tracks four types of input requests:
This matters for exposure validation workflows where the distinction between testing and exploitation must be enforced by policy, not convention. The HITL system is that enforcement mechanism.
The individual agents are useful. The architecture is the real product. Four properties separate this from a collection of AI-assisted tools:
An agent testing an application on day 3 of an engagement has full context from day 1: every crawled endpoint, every tested parameter, every credential tried. This context is stored in shared tables and learnings that any agent in the workspace can query. Traditional pentesting loses this context the moment an engagement ends. Strobes retains it indefinitely, making re-assessment a genuine comparison rather than starting over.
A 20-host network segment gets all its services tested simultaneously, not sequentially. A web application gets all 11 WSTG test categories designed in parallel. The time savings are multiplicative, not incremental. This is the property that makes continuous adversarial exposure validation operationally realistic rather than aspirational.
No human copy-pasting context between tools. A finding moves automatically through the pipeline: discovery, validation, enrichment, assignment. The agents that handle each step are specialists. The workflow that connects them is defined once and runs consistently. This is what separates the Strobes architecture from earlier approaches to building an AI harness for offensive security.
A completed pentest can be re-run with a single click - "Re-run All" or "Restart from Phase X." Regression testing and continuous re-assessment of the same target become trivially executable. For teams managing large-scale continuous exposure programs, this property transforms pentesting from a quarterly point-in-time event into a persistent, always-on capability.
The numbers Strobes cites aren't from controlled demonstrations. Against a real web target, the platform executed 32 structured phases, found 42 vulnerabilities with working payloads, and ran 134 tool invocations - all documented, structured, and pushed directly into the CTEM findings pipeline that connects to ticketing systems, SLA engines, and risk dashboards.
Against a 20-host network segment, the Network Pentest Agent ran service enumeration and multi-host testing in parallel. The findings pipeline handled the same workflow: discovery to triage to ticket, without human intervention at each handoff.
