EXECUTION CYCLE
In the web and API engine, workers investigate, observations merge, and new endpoints or candidate findings can create further work. This is an execution loop, not a promise that every lane uses the same mechanism.
01
02
03
04
05
For example: reconnaissance identifies an authenticated API endpoint. An authorization specialist compares the supplied identities. If a candidate access-control issue emerges, a verifier attempts reproduction before the result is reported.
Workers receive relevant identities and a bounded digest of earlier findings. More intrusive AI interactions require their corresponding explicit selection.
THE SWARM
Role availability varies with the target, enabled modules, evidence, and permissions. Functional roles do not imply separately trained foundation models or a permanent, fixed-size agent roster.
Specialist area
Contribution to the engagement
Reconnaissance & discovery
Explore reachable pages, endpoints, parameters, and supported technology signals.
Authentication & authorization
Use supplied identities and supported login flows; investigate token controls and differences in access.
Web & API exploitation
Investigate enabled injection, access-control, upload, GraphQL, and business-logic capabilities.
Secrets & disclosure
Examine supported responses, client-side JavaScript, and distributed artifacts for sensitive information.
Mobile analysis
Combine package analysis with real-device exploration and available captured traffic.
AI red teaming
Investigate supported AI-facing services and selected prompt, retrieval, tool, or vector-store boundaries.
Verification
Attempt reproduction of candidate web and API issues and record the resulting verdict.
LEARNING WITH REVIEW
Approved lessons carry organization-specific knowledge into later campaigns. Recursive self-healing adds bounded post-operation review where enabled. Neither mechanism establishes automatic model-weight retraining or autonomous production code rewriting.
Mechanism
What it contributes
Boundary
Approved lessons
Analyst reasoning can become proposed guidance; eligible approved lessons enter later hunt context.
Organization-scoped and context-limited. Lessons guide investigation, not a veto on reproducible findings.
Recursive review
Revisit uncertain findings through bounded post-operation review cycles where enabled.
Conditional enablement; explicit stopping conditions prevent indefinite recursion.
Meta-learning architecture
Designed to propose changes to review strategy, retrieval weighting, and calibration context.
Proposals do not demonstrate changed live-verifier behavior or measured improvement.
01
02
03
04
05
Inspect proposed text, approve or reject it, revoke guidance as conditions change, and export approved lessons as Markdown. Revoking a lesson does not automatically remove its originating suppression rule.
VISIBLE LIMITS
Review the evidence behind a lesson and the analyst decisions behind a metric. Autonomy reduces routine direction, while your team retains meaningful decisions about access, scope, and operational control.
Control or measure
How to interpret it
Campaign scope & access
Your targets, identities, network vantage, assessment depth, and enabled capabilities determine what can be examined.
Pause & stop
Use supported campaign controls or organization-wide stop controls. Pause behavior can differ by testing lane.
Recurring campaigns & CI/CD
Choose an authorized cadence; use supported pipeline integrations and thresholds for release decisions.
Recursive stopping conditions
Depth limit, repeated configuration detection, no further proposals, or resolution of the uncertain findings.
Precision view
Uses human triage outcomes and calibration context, not an independent recall benchmark or probability of complete security.
TALK TO ASSAIL
See how Ares carries an authorized campaign from discovery to reporting and brings approved lessons into future assessments.
Your environment. Your objectives. A mission built around both.
