Signature coverage
A vulnerability scanner is useful for the checks it supports. Its coverage is defined by signatures, templates, and the surfaces it knows how to test.
What is an autonomous pentest copilot?
An autonomous pentest copilot carries out repeatable testing work inside a human-authorized scope while leaving boundaries, judgment, and final decisions with the tester. RedDepth adds an independent validation pass so a candidate finding is not called confirmed merely because one agent proposed it.
More coverage, with a human still in control.
“Autonomous” describes the testing work the system can carry out between human decisions. It does not mean that scope is guessed, authorization is inferred, or a report is accepted without review. A useful copilot makes the repeated work more systematic while making its boundaries and evidence easier to inspect.
That distinction matters in offensive security. A finding can be technically interesting and still be unsafe to submit if it was not reproduced, if it crossed a scope boundary, or if the evidence does not support the claim. RedDepth is designed around those failure modes.
A copilot is not the same as a scanner.
Prompt-dependent work
A generic agent may be able to reason about a target, but a prompt alone does not create an independent validation contract or a reliable record of what remains untested.
Judgment bounded by hours
A skilled tester can go deep, but large surfaces force tradeoffs. Repeating the same permutations across parameters, identities, and state transitions consumes attention.
Supervised systematics
RedDepth maps and tests an authorized scope, then sends candidate findings through an independent reproduction and a separate coverage-audit pass.
What RedDepth does not claim.
- It is not fully autonomous or unattended. A human defines scope, orients each session, and reviews findings.
- It does not create authorization. Testing stops when ownership, scope, or an action is ambiguous.
- It does not guarantee that every vulnerability will be found or that coverage is complete.
- It does not replace the tester's responsibility to follow a program's rules or confirm its AI-submission policy.
The useful claim is narrower: RedDepth takes the systematic sweep off the tester's plate while keeping authorization, independent verification, and final judgment visible.