Reflectiz Launches AI Agent Team That Attacks Your Website So Criminals Don't Have To First
A new platform sends four specialised AI agents to probe websites for weaknesses continuously, not just once a year. Whether that closes the gap between releases and real-world attacks is the right question to ask.
Key points
- Reflectiz launched a multi-agent penetration testing platform for websites on 15 July 2025, claiming up to ten times the coverage of conventional tools.
- Traditional website security tests, called penetration tests or "pentests", happen once or twice a year; the new platform runs them continuously as sites change.
- Four specialised AI agents divide the work: one maps the site, one identifies attack types, one carries out attacks, and one independently checks every finding before it goes into a report.
- The platform draws on a decade of live website data Reflectiz already holds, so agents start with a detailed map rather than probing a site cold.
- Customers in retail, finance, healthcare, and other sectors can connect results to existing engineering tools through standard integration points.
What is a penetration test, and why does once a year fall short?
A penetration test, shortened to pentest, is when a security team deliberately tries to break into their own system to find weaknesses before criminals do. Once or twice a year is the industry norm. The problem is that most websites change every week.
New payment buttons, third-party chat widgets, updated login flows: every change is a potential new opening. By the time the annual report lands, it describes a website that no longer exists. The criminals probing those sites don't take the year off.
"Websites change every week and get pentested once or twice a year. That gap is where exposure builds up," said Idan Cohen, CEO and co-founder of Reflectiz.
How does the Reflectiz platform actually work?
Instead of starting blind, the platform draws on a live map Reflectiz has built over ten years of scanning thousands of production websites. That map covers every page, third-party script, login form, and payment field.
Four AI agents then work as a team. The first crawls the site as a real visitor would, including through login pages and two-factor authentication (the extra code sent to your phone when you sign in). A second works out which attack techniques apply to what it finds. A third carries those attacks out and strings discoveries together into chains. The fourth, and arguably the most important, independently checks every finding before it reaches anyone's screen. Unconfirmed findings are filtered out.
The practical result is that a developer gets a report saying: this specific script on your checkout page can expose this specific data, and here is the exact sequence to reproduce it. No weeks of follow-up investigation.
| Agent | Role |
|---|---|
| Crawler | Maps pages, logins, and third-party scripts as a real user would |
| Fingerprinter | Identifies which attack techniques apply to which parts of the site |
| Attacker | Executes attacks and chains findings together |
| Validator | Independently confirms each finding before it enters the report |
Should ordinary website users be worried?
This launch is a product announcement, not a breach. But the gap it describes is real, and it affects anyone who shops, banks, or books appointments online.
Third-party scripts, the small pieces of code that websites load from outside companies to run chat boxes or analytics, sit in most major websites and rarely get tested as thoroughly as the core site itself. That is one of the better-known routes criminals use to silently collect card numbers or login details from visitors.
If you use a service that processes your payment or health details online, the sensible habit is the same as always: watch your bank statements, turn on alerts for card transactions, and be cautious about saved payment details on accounts you use infrequently.
The failure mode here is not the tool; it is the assumption that annual testing is enough when the attack surface refreshes weekly. One operational takeaway: if your engineering team ships code faster than your security team tests it, you already have the gap Reflectiz is selling against.
