Methodology

How autonomous testing is supposed to work.

This describes the intended testing loop. It is not a benchmark and it does not claim complete ATT&CK coverage or a published accuracy rate.

Nubesti LLC Delaware, United States

  1. 01

    Define authorized scope

    The customer verifies assets and authorization. KYC must be complete and paid.

  2. 02

    Autonomous reconnaissance

    Nubesti maps the authorized attack surface — not the open internet.

  3. 03

    Attack simulation and validation

    Agents test exploitable paths inside that scope and keep evidence.

  4. 04

    Evidence

    Each finding should include technical context a reviewer can accept or reject.

  5. 05

    Remediation

    Recommendations or draft fixes when available. Drafts are a starting point.

  6. 06

    Retest

    The same finding can be tested again after a change.

Autonomous testing

After a customer verifies assets and authorization, Nubesti can run repeatable test playbooks against that scope without waiting for a quarterly manual pentest. Humans still define scope, pay for KYC, can halt jobs, and decide what to patch.

The loop

  1. Authorized scope — only listed assets
  2. Reconnaissance — map the authorized attack surface
  3. Testing and validation — probe exploitable paths; prefer evidence over scanner noise
  4. Evidence — findings should include technical context a reviewer can replay or reject
  5. Remediation — recommendations or draft fixes when the product can produce them; drafts are a starting point, not a guarantee
  6. Retest — the same finding can be tested again after a change

Mapping, not “full coverage”

Workflows can be mapped to MITRE ATT&CK techniques and to OWASP risk classes. Mapping is not the same as exercising every technique in the matrix. Reports should show which mapped techniques ran and which did not.

Severity

Severity is contextual. Where a Risk Index or CVSS-like score appears in the product, treat it as decision support for a change window — not as a legal rating or a promise of completeness.

False positives

We aim to reduce noise with exploitability checks and evidence. We do not claim zero false positives or a public 99% accuracy figure.