XBOW is the world’s first fully automated web pentester. It previously scored an unprecedented 75% on renowned web pentesting benchmarks from PentesterLab and PortSwigger. So we decided to give it a harder challenge: competing against humans.

We created 104 novel benchmarks that include every web vulnerability class you see in the wild: from SQL injection through IDOR to SSRF. We hired 5 pentesters from well-established pentesting companies.

In 28 minutes, XBOW matched 40 hours of work by the most experienced pentester, who has 20 years of experience, with both solving 85%.

For more details, read more about the experiment here:

Here are some things experiment participants have said:

If you’re interested in seeing how XBOW performs on a specific benchmark - either a public one like PortSwigger or a novel XBOW one - let us know below, and we’ll try to share some traces! You can see a full list of benchmarks XBOW has solved here:

@PentesterLab @PortSwigger Game changer. Congratulations team!!

@PentesterLab @PortSwigger Thank you very much!

@PentesterLab @PortSwigger This isn't the world's first. @Kei0x has been doing this since at least December last year

@PentesterLab @PortSwigger Video says “The AI resets the admin password user - a classic Server Side Request Forgery”, not sure about the wording there 😅

@PentesterLab @PortSwigger Great demo and presentation!

@PentesterLab @PortSwigger Thank you!