What a pentest looks like when seven AI agents run it: a tour of Insomnia

Insomnia — Thu, 05 Nov 2026 15:19:16 GMT

A typical external pentest follows the same path every time. Map the attack surface, scan it, sort the noise from the real findings, try to exploit what looks promising, and then spend a day writing it all up. Most of that is repeatable work, and repeatable work is exactly what software should take off a tester's plate.

That is the idea behind Insomnia (insom.ai), an autonomous AI pentesting suite built by CQR Cybersecurity. This post walks through what it does, module by module, with real screenshots from the app.

The demo, if you prefer video

Full voiced walkthrough (36 min): https://insom.ai/static/video/demos/00-insomnia-full-walkthrough-voiced.mp4
36 short module demos, from the web scanner to the C2 and Report Studio: https://insom.ai/en/videos

How the engagement runs

You give Insomnia a target and a scope. A team of seven AI agents then works through the engagement on its own: recon and OSINT, port and service discovery, web and API scanning, CVE validation, exploitation, privilege escalation and, at the end, the report. Each stage feeds the next, so a forgotten subdomain from recon becomes a scan target, and a confirmed vulnerability becomes an exploitation attempt with proof attached.

Because Insomnia ships an MCP server, you can also run an assessment from an AI assistant and ask for things in plain language.

Module tour

Dashboard and scanning. 275+ web attack modules covering SQLi, XSS, CSRF, JWT, GraphQL and API testing, plus 20+ protocol scanners matched against 30,000+ CVEs.

Proxy and OSINT. An intercepting proxy for manual work, and an OSINT canvas with 200+ transforms for mapping people, domains and infrastructure.

Exploitation. A payload and attack configuration arsenal, so findings can be proven instead of just reported.

Active Directory. AD auditing with BloodHound mapping to find attack paths to domain admin.

Cloud and infrastructure. Checks for cloud and infrastructure misconfigurations.

Command and control. Post-exploitation tooling for authorized red team work.

Reporting and knowledge base. Report Studio builds PDF, DOCX or HTML reports with CVSS scoring and remediation steps in one click.

Network utilities. The everyday tools a tester reaches for, in the same place.

The free part: SAST CLI

The static analysis engine is free. It looks for vulnerabilities and leaked secrets in source code and checks whether found keys are still live. It also plugs into CI/CD, VS Code and JetBrains.

pip install sast
# or
npm i -g sastai
# or
docker pull dominators/sast

GitHub: https://github.com/vulnz/sast

Pricing

Community Edition: free
SAST CLI and CI/CD wizard: free
Advanced: $149 per month
Pro: $399 per month
Enterprise: on request

Who should look at it

MSSPs that want to test their whole client base continuously, red teams that need more output without more people, and DevSecOps teams that want real attack checks in the pipeline.

As always, only test what you own or have written permission to test.

Product site: https://insom.ai