PortSwigger Scales Burp AT for Enterprise Testing Programmes

Specialist agentic pentesting helps security teams investigate more applications in depth, with authority they control and boundaries Burp enforces

KNUTSFORD, England, Nov. 5, 2026 /PRNewswire/ -- PortSwigger, the company behind Burp Suite, today announced the availability of Burp AT for enterprises, an agentic pentesting solution that helps security teams investigate important applications more deeply and more often.

Burp AT combines specialist Burp tools, purpose-built pentesting skills developed with PortSwigger Research, and relevant application context. Agents plan their testing approach, use Burp's web security testing tools, and adapt as they learn.

For AppSec leaders balancing testing priorities with limited expert capacity, Burp AT helps teams pursue investigations that would otherwise wait, revisit applications as they change, and carry out in-depth testing more often, over more of their estate.

Security teams choose how much authority to delegate, from guided investigations to autonomous execution of defined tests. Burp deterministically enforces configured scope and permissions, not the model itself, while experts assess the evidence to decide which weaknesses to address and where further investigation is needed.

"Pentesters have shown what agentic testing can do on a single application with Burp AT," said Chris Wood, Product Manager at PortSwigger. "The question for security teams is how to bring that to a whole application estate without losing control. Burp AT now lets teams run agentic tests at scale, with the scope and safeguards set in advance, whilst ensuring that teams can stop and see what the agent is doing. Teams get that depth across more of their applications, with control built in."

Testing with specialist tools and research-led methods
Burp AT helps teams bring specialist testing depth to more applications, equipping agents with the Burp tools professional pentesters use and purpose-built skills developed with PortSwigger Research.

The specialist tools are designed to handle malformed traffic and unusual behaviour that is inherent to security testing. Research-led skills give agents structured methods to pursue promising leads and adapt to the evidence, so organisations get consistent, comparable results across every application they test.

"The best results from agentic testing come from giving agents the right tools, not just a capable model," said Tom Shelton-Lefley, Product Manager at PortSwigger. "Burp AT lets agents use Burp's specialist tools autonomously, guided by workflows our researchers have tested in practice. In Burp AT, an orchestration layer ties those tools together into a complete test that helps agents remain consistent across tests by following defined pentesting methodologies. The agent brings the reasoning, and Burp brings the precision, which is how autonomous testing delivers the depth teams need."

Autonomy on the organisation's terms
Organisations choose how much testing to automate and where their teams stay closely involved, from user-guided to autonomous execution of defined tests. Teams can increase or reduce the authority they delegate according to the application, task, and organisation's risk appetite, whilst retaining the ability to step in when needed.

Whatever level of autonomy you choose, Burp enforces configured scope and permissions, not the model itself, meaning agents cannot execute actions the tooling layer does not permit, thus maintaining testing boundaries as more execution is delegated. Teams retain visibility into test activity and the evidence behind findings, giving them the oversight to assess results and make decisions about risk.

For organisations interested in Burp AT 
To talk to us about Burp AT for your organisation, please fill out this form.

For more information, visit: https://portswigger.net/burp/burp-at.

Heading to OWASP Global AppSec USA in San Francisco this year? Meet the PortSwigger team at booth G14 on the 5th and 6th November. Request a meeting slot with our team 

About PortSwigger
PortSwigger is on a mission to enable the world to secure the web. The company is behind Burp Suite, the industry-standard web security testing platform used by more than 90,000 security professionals and 18,000 organisations across 170+ countries.

PortSwigger's products span practitioner-led testing and enterprise application security. Burp Suite Professional equips security professionals to investigate vulnerabilities in depth, while Burp Suite DAST helps more than 1,000 organisations automate security testing at scale. PortSwigger also works strategically with global enterprises including SAP, and combines its software with pioneering security research and free practical training to advance how the web is secured.

Learn more at portswigger.net.

Media contact:
Kieron Hughes, VP Marketing
kieron.hughes@portswigger.net

SOURCE PortSwigger