Platform
Autonomous does not mean unsupervised
The first question any security lead asks about an autonomous agent is whether it can break production, and who authorised it to try. Here are both answers.
Scope
The estate is declared before anything runs
Revelion does not discover its way into systems you did not authorise. Scope is an input to the mission, not a boundary it works out along the way.
- Targets are explicit
- Hosts, domains and ranges are declared up front. Anything outside the declaration is out of bounds.
- Exclusions are honoured
- Systems you name as off-limits stay off-limits, including hosts discovered mid-mission.
- Scope is recorded with the run
- Every mission carries the scope it executed against, so the record is auditable afterwards.
Control
You decide what the agent may do unattended
Autonomous does not mean unsupervised. Exploitation is the step where judgement matters most, so it is the step you keep control of.
- Approval gates
- Nominate the actions that require a human to approve before the agent proceeds.
- Steerable mid-mission
- Redirect the engagement while it is running rather than waiting for a report to disagree with.
- Destructive actions are opt-in
- Anything with the potential to disrupt a service requires explicit authorisation, not a default.
- Full action log
- Every action the agent took is recorded, so the engagement can be reconstructed later.
Authorisation
Testing runs against a Letter of Authorisation
Penetration testing without documented authorisation is difficult to defend, whether the question comes from your board, your client, or a regulator. It matters more, not less, when testing recurs this often, because there is no single engagement window to point at.
Revelion publishes a Letter of Authorisation template covering the estate in scope, the window, the permitted actions and the named parties. For MSPs testing on behalf of clients, it establishes that the client authorised the work rather than the provider assuming it.
The authorisation record sits alongside the mission history, so the question "who approved this, and when" has an answer that does not depend on somebody remembering.
Production safety
Designed for estates that cannot go down
Most environments worth testing are environments in use. The controls that make that safe are built in rather than bolted on.
- Rate and concurrency limits
- Testing intensity is bounded so a mission does not behave like a denial-of-service attempt.
- Proof over persistence
- The agent demonstrates access and stops. It does not establish footholds or leave artefacts behind.
- Reversible by default
- Actions that would change state require explicit approval before the agent takes them.
- Scheduling windows
- Run against production inside the windows you nominate, not whenever a schedule fires.
- Immediate stop
- A mission can be halted at any point, and stops without leaving work half-completed.
- Clean-up is part of the run
- Test data created during a mission is identified so it can be removed.
Read the authorisation template before you scope anything.
Talk to us about scope