Cyber security / Case study

Agentic AI
Pentest Platform.

Connecting traditional security tools with local AI reasoning. An end-to-end, multi-agent platform that coordinates the penetration testing workflow.

Built for
nSec / Resillience
Period
February - July 2026
Focus
AI & security automation
nSec vulnerability dashboard
A consolidated view of the agent findings.

01 / THE CHALLENGE

The challenge

A comprehensive penetration test involves a lot of manual overhead. Before scanning starts, security engineers parse intake notes to determine the scope, targets, and credentials. Reconnaissance and vulnerability analysis then require switching between tools, interpreting noisy output, and handling failures on large datasets.

I built a platform to coordinate that work, combining established security tools with AI agents that reason about the next steps.

02 / THE WORKFLOW

The workflow

The workflow starts with a local language model, running through Ollama, that parses raw client intake notes into a structured JSON configuration. This defines target URLs, in-scope paths, and the required authentication flows.

With the scope configured, an asynchronous Python backend coordinates specialized agents for OSINT, DNS reconnaissance, IP analysis, and web vulnerability scanning. The agents run concurrently and stream their output back to the frontend.

  1. 01

    Intake

    Turn client notes into a structured scope.

  2. 02

    Reconnaissance

    Coordinate specialized discovery agents.

  3. 03

    Analysis

    Use AI reasoning to prioritize targets.

  4. 04

    Reporting

    Bring findings together in the dashboard.

Pentest orchestrator interface showing AI agent activity
Specialized agents coordinate the investigation.

03 / AGENTS IN PRACTICE

Reconnaissance agents

The Domain Fly-over Agent is an example of that approach. It collects subdomains with Subfinder and sends the results to the AI model. The model reasons about which targets need attention, such as admin panels and development environments, and adjusts the scanning profile to help prevent tool crashes.

Tools such as Aquatone then provide targeted visual inspection. The agent connects discovery, prioritization, and tool execution in one workflow.

04 / UNDER THE HOOD

Technical architecture

The backend uses FastAPI and Python’s asyncio to run concurrent operating-system tasks. An asynchronous queue streams log output from each agent to the frontend, making the progress of the pentest visible in real time.

The project runs in Docker, using a Kali Linux base image with security tools such as Nmap, Amass, and Aquatone integrated into the Python orchestrator. Local language models through Ollama provide the reasoning layer.

AI reasoning output from the nSec pentest platform
A look at the reasoning behind the agent’s next steps.

05 / WHAT I BUILT

What I built

This project brought together asynchronous Python development, local AI integration, Docker and Linux infrastructure, and the workflow of an ethical hacker. It was an opportunity to turn security knowledge into a working multi-agent system.

Explore more projects