Synack's Agentic AI Pentest for Speed and Scale

00:03 I'm gonna pop up the Synack platform here and actually walk through what it looks like creating a Sara Pentest in the platform. We start here at the asset level here, and we have a discovery capability built into the Synack platform here. So what you can do is create a seed group. Typically, I show people that you can discover some assets here by giving a seed group name, can define access, enter a seed, and you can run discovery just like this. That gives you a asset list, which is populated with the assets that we discover in the platform.

00:35 So we've made an effort to make asset management in the Synack platform very easy and also powerful so that as you do activity in the platform, as you do things like import vulns from a source like Tenable or Qualys and you do lots of testing activity, you can quickly sort by things that have the most suspected vulns or things that were most recently tested or things that haven't been tested in a long time. So for this demo, I'm just gonna grab the acme.com asset that I created and do create test. And here, we have a pretty self explanatory menu of the testing

01:05 options that we have. We have our core human driven open vulnerability discovery engagements here below, like our fourteen day pentest or our crown jewel offering the Synack 365 year round pentest. At the top of it for this demo, I'll select the Synack Autonomous Red Agent, Sara Pentest here. So you can select that, continue on, And then you provide some simple information about what the group of assets is to you. So maybe this is your main customer facing retail website. Give us information about it, articulate the scope.

01:36 You can add tags to it. You can add an owner to it so that we know who to contact about the test. Different things like that that over the years of pen testing through the Synack platform, we've identified are useful for for test management and test creation. Give the test a name. So maybe this is your monthly or quarterly compliance test. Again, specify information about the scope. Enter the start date you want, outage windows when you want the testing to pause, more information about people who should receive a notification when the testing begins via email,

02:06 or you can add them to the platform. We have here a pretty cool feature, an asset reachability scan, powered by AI to tell you whether or not we can see your assets properly from the Synack platform and kinda give you an idea of the access across the maybe two hundred fifty hosts you provided, how many of them are actually up and responding. Pretty useful tool for people as they schedule their own tests. And then you can go ahead and submit it. And it's as simple as that. After it's submitted, the Sara Pentest will go live. And you can go into that group of assets, in this example,

02:37 the Acme web assets. And maybe you have many tests here. Maybe you have it adjacent to some of the open vulnerability discovery pen test with humans. The Sara Pentest will be there. It'll be marked as completed after the after the test is finished, and you'll have a viewable report here. And so in just a second, Mark, I'll pass it over to you to talk more about what is the agent actually doing during the test. But the net net of the test management flow is what I just showed, and it results in a nice viewable report here that contains an executive summary,

03:08 details about when the test was performed, the scope over which was performed, and, of course, any vulnerabilities that Sara found during the pen test. So with that, I'll stop sharing and, pass it back to you, Mark. Hey. Thanks, Brandon. That's really great. I'm gonna jump in and show a little more detailed demo. The Sara Pentest is intended to be a very, good compliance pen test. You know, so if you wanna just run a test that covers, like, on web, the OWASP top ten, It's a great product for that.

03:38 They run quickly. We also offer a variety of human tests that, you know, may go into more depth. But the Sara Pentest initially that we're launching is is a great fit for your compliance pen testing and identifies, you know, surface level risks that, you know, may exist. So I'm gonna show you a little bit about what happens in during the pen test. You know, let's look at, you know, one of the agents. So let's say, you know, during the pen test, we're running scanning. Those scanner findings could come in as well as part of that pen test. And, you know, let's look at what the agent would do on on some of these

04:10 scanner findings. In the context of a pen test, you know, this would just happen automatically, but I'm gonna show you a discrete action of one vulnerability that it's identified. And this would happen automatically, but we have a UI if you wanna do it one off as well. So in in this case, the vulnerability was discovered was a open BSD open SSH issue. It was identified by a couple CVEs. We can go ahead and submit that for Sara Triage. So let's do that here. And what's happening behind the scenes is this vulnerability

04:40 information is being assessed by the agent. It's spinning up those agent specialized agent vulnerability hunting subsystems that we talked about, and those sub agents are going off to prosecute this vulnerability and see if it's actually vulnerable. If it's accurate, it'll determine if it's exploitable as well. Alright. Here we go. The agent thinking's already popping in. So it's gotten the initial information and it's starting to talk to the machine. It's got oh, it's got some tools here. It looks like it's got an exploit from a nuclei template,

05:12 and it's gonna attempt to run that against the target. It's gonna start connecting to the server, examining the the key exchange algorithms that are relevant for this, Terrapin attack. And then it's gonna, as a next step, throw that attack safely at the, end target. In a Sara Pentest, this all happens at the same time behind the scenes with many agents and and you view the end result in the report that Brandon, highlighted. But if there was actually a vulnerability, that was exploitable, you'd have,

05:42 that showing up under the vulnerabilities tab here in the platform too. We're waiting to for the agent to do its work. This typically takes about three minutes. Looks like Sara's finished its thinking and determined that this vulnerability is not exploitable, which is good. So it's gonna save us a lot of time on remediation because Sara's already taken a look at this vulnerability and said, hey, based on my recon and my assessment with a variety of tools, it's not vulnerable to this CVE,

06:12 and we can move on. So it's already closed it as not exploitable. This is a good outcome. Now I think we should do one more look under the hood, perhaps. What do think, Paul? What are we looking at here whenever we're looking at the the walk through of this this pen test engagement? Yeah. So one of things we wanted to show here was, you know, it was great fun showing, you know, the agent exploit a CVE. But thought it would be fun to kinda show a web application in the context of a of a lab environment and show the agent exploit that, lab environment and find a vulnerability in there.

06:46 So one of the things that the agent can do with with web applications is authenticate to them and then start to crawl the pages and fuzz and look for, injection points. And so that's what we're seeing in in this example. It's starting to crawl the sample app here, and look for potential vulnerabilities. In this case, you know, one of the more complicated vulnerabilities is a blind SQL injection where, you know, it's a timing related issue. And so we're gonna see the agent prosecute this target and

07:17 run through a series of of queries and see if it can spot the timing issues in in the request. It's interesting. I see right here that we've already completed the recon phase against it. We're select starting to select various tooling and modifying what tools we plan to use based upon what we saw in recon. That's right. Yeah. So we're we're past that recon phase. Now we're selecting our toolkit. We're moving into the, specialized attack section of the the agent workflow, and it's starting to spin up in parallel a bunch of different

07:48 tasks to start to prosecute that target. Next up, you know, we're gonna see it attempt a bunch of requests and start to see what looks normal and what looks abnormal. And a lot of the behaviors that, you know, we we are expecting the agent to identify are things that, you know, we train pen testers on. So, you know, we're training these agents, you know, very similar to how we train a human pen tester. We were training them to to become a specialist at spotting these types of vulnerabilities, and the agents are getting quite good, at these things.

08:19 Well, this is a somewhat trivialized example for the purpose of a demo, you know, testing these in the wild, it's it's finding a lot of vulnerabilities that would have taken humans quite a long time to find. And some of our advanced pen testers have have been running the agents side by side, and, you know, they're finding it's super helpful at finding things faster than them, you know. And and just one, you know, example, one of our pen testers was saying, you know, this probably would take me four or five hours. The agent did it in about, you know, twenty minutes. So it's a pretty great time savings,

08:50 especially if you think about, you know, you're also offloading that work to the agent and letting it letting it do its thing. So you could run many many of these at the same time. And that's exactly what Sara Pentest does during its workflow, is it's prosecuting that target in parallel with a bunch of different tools and a bunch of different specialized agents and you know, yielding results at the end. And you can see all the different sub agents kicking off, running tools, getting feedback, feeding it back in, running the next series of tools based upon kinda trial and error.

09:21 Let's skip forward to the end and see how it see how it performs, see if it's solved the lab. Alright. We've been letting the pen test run for for quite a bit of time. I think we're nearing the end of the execution cycle of it. Let's see what it ultimately turns out to be, or what the outcome is after this it's running against this web app for a while. It looks like it's running its final task. It's trying to build out its final report. It solved the lab. Look at that. It did solve the lab. Not only that, I'm if I'm reading this correctly, the blind SQL injection was successful.

09:52 I was able to extract the administrator username and password. Is that is that accurate statement there, Mark? Yep. Full compromise right there. It's very promising. It's gonna be be very interesting to see this deployed at scale across customer environments to to look for those vulnerabilities. Absolutely. Really powerful companion in the security testing process. That was that was really exciting to see the the pen test go from start to finish and see kind of some of the underlying sub agent workflows. We hope this has been a really insightful session.

10:22 Thank you again, Mark. Thank you again, Brandon, for for spending the time today and helping educate our customer base. If you wanna learn more about Synact's agentic AI, just make sure you can reach out to us. It's https://go.synack.com/demo. There's a form to fill out. Ultimately, you can engage with us, and we'll we're happy to hear what your use cases are and and see how it fits in your portfolio. Thank you all.