Insomnia: an autonomous AI red team that runs a pentest from recon to report

Most companies get a real penetration test once a year, if that. A senior tester spends days on recon and scanning, chains a few exploits by hand, and then writes the report. It is slow, it is expensive, and it does not scale.

Insomnia is our attempt to fix that. It is an autonomous AI pentesting suite: you point it at a target and a team of seven AI agents runs the whole engagement on its own, from recon and OSINT to scanning, CVE validation, exploitation and privilege escalation, then hands you a client-ready report.

Watch it in action

• Full 36-minute voiced walkthrough: https://insom.ai/static/video/demos/00-insomnia-full-walkthrough-voiced.mp4
• Short demo of every module (web scanner, OSINT canvas, Active Directory, C2, Report Studio, MCP server and more): https://insom.ai/en/videos

What the AI red team does

The seven agents split an engagement the way a human team would. Recon and OSINT feed targets to the scanners, findings get validated against known CVEs, and the exploitation side tries to prove real impact instead of dumping a list of maybes. Everything ends up in one report with CVSS scores and fixes.

It is also MCP-native, so you can drive a full assessment from an AI assistant in plain language.

What is inside

• 275+ web attack modules: SQLi, XSS, CSRF, JWT, GraphQL and API testing
• 20+ protocol scanners with matching against 30,000+ CVEs
• OSINT with 200+ transforms on a visual canvas
• Active Directory auditing with BloodHound mapping
• Intercepting proxy, fuzzing and out-of-band testing
• Cloud and infrastructure checks
• Command and control for post-exploitation
• Report Studio: one-click PDF, DOCX and HTML reports with CVSS scoring
• CI/CD pipeline builder, plus VS Code and JetBrains plugins

Screenshots

Dashboard and live scanning across 275+ modules

Intercepting proxy and OSINT reconnaissance

Exploitation arsenal and payload configuration

Active Directory attacks with BloodHound mapping

Cloud and infrastructure security testing

Command and control with post-exploitation

Reporting and knowledge base

Network utilities

Free SAST CLI

The static analysis engine is free and open. It scans source code for vulnerabilities and leaked secrets, and validates live keys.

pip install sast
npm i -g sastai
docker pull dominators/sast

Source and docs: https://github.com/vulnz/sast

Pricing

Who it is for

• MSSPs that want continuous testing across their whole client base
• Red teams that need a force multiplier, not another headcount
• Dev and DevSecOps teams that want real security checks in CI

Please only test systems you own or have written permission to test.

Try it: https://insom.ai

We would love feedback from people who run pentests for a living. What would you want an autonomous red team to never do on its own?