Your first agentic pentest: choose a target that can teach your team something useful

Sources checked: 2 November 2026. FailSafe Research.

The best first target is usually a workflow your team understands well enough to authorize, investigate and fix. Start with a business consequence, then choose a bounded application surface that can provide a useful answer. That makes a first assessment a practical evaluation of SWARM as well as a security exercise.

Shortlist by consequence and ownership

Look for an application or API that handles an important action and has a clear engineering owner. Compare the consequence of a boundary failure, the access you can safely provide and the team's ability to investigate a result. Avoid selecting the largest estate simply to maximize the apparent scope.

A useful target might represent a customer-facing workflow, a sensitive permission boundary or a recently changed service. Confirm which surfaces the portal's available black-box configuration can support. Specialized AI, internal-network, mobile or connectivity requirements should be reviewed for fit before purchase.

Check readiness before you launch

Confirm written authority for the target, permitted test windows, excluded actions and an operational contact. Prepare the application details the approved portal flow requires. Sensitive credentials and scope belong in the authorized configuration channel, never a public URL or marketing form field.

Identify the engineer who will receive findings and the person who can approve any remediation. A target with no owner can create another backlog even when the assessment produces useful evidence. The first engagement works better when the team has a realistic path to act.

Understand the package and the next step

The one-time Startup offer is $999 USD, reduced from $6,500, for 250 credits and one agentic black-box run. Review the offer terms and scope before signing in to SWARM. The portal supports Google or email/password, with account creation and any verification steps it requires.

After sign-in, open the credit balance, choose Top up, select Startup and complete Stripe checkout. Configure the authorized run after the credits appear. If a charge is present but credits are delayed, ask the team to check the order before trying to pay again.

Decide what would earn the next assessment

Review the reproducibility of the findings, usefulness of the report, clarity of the engineering guidance and the effort required to configure the test. Use the agreed scope and access to interpret what was covered. The report window begins after full access is available for the agreed assessment.

A first run can inform a broader SWARM program. Custom enterprise scope, source-aware remediation and sovereign infrastructure are separate planning decisions. Choose the next step from what the team learned, rather than assuming one black-box run covers every part of the business.

Use a short selection conversation

• Consequence: which business action would matter if the boundary failed?
• Readiness: can the target be tested within the available configuration and written authorization?
• Ownership: who can investigate the finding and approve the next change?

Source review, 2 November 2026: FailSafe Startup offer and portal purchasing flow. Eligibility and current package terms are shown in SWARM before checkout.