Smart Automated Testing

AI-driven API security testing that reasons, acts, and iterates to find vulnerabilities.

Smart Automated Testing is Akto's AI-powered testing mode where an intelligent agent takes over the execution of security tests. Rather than mechanically replaying pre-defined payloads, the agent reasons about each test, forms a plan, executes HTTP requests, observes the response, and refines its approach across multiple attempts — all to determine whether a vulnerability is real.

How It Works

The agent follows a Think → Plan → Act → Observe loop, repeating until it either confirms a vulnerability or exhausts its attempts. Each iteration builds on what the previous one learned.

Execution Loop

Step	What Happens
Thinking	The agent reads the test scenario and baseline request, then reasons about what a successful exploit would look like — which parameters to change, what response signals matter (status code, body similarity, error messages).
Plan (Attempt N)	Before sending a request, the agent decides exactly what to change and why — e.g., swap the auth token with a different user's token, alter an object ID, or craft a malformed payload.
Action (Attempt N)	The agent sends the crafted HTTP request. The full request is logged: method, URL, headers, and body.
Observation (Attempt N)	The agent reads the response — status code, body, headers — and judges whether it indicates a vulnerable or secure state. If the response is not conclusive, it adjusts and tries again.
Vulnerability Validation	After all attempts, the agent checks the key indicators defined in the test scenario — e.g., HTTP response code is 2XX, response body matches the baseline by more than 90%, no error message present. If criteria are met, the issue is flagged as confirmed.

How to Run Smart Automated Tests

Smart Automated Testing runs the same way as standard tests — you select the tests you want to run, and the AI agent executes them.

1

Open Testing

Go to Testing and open a collection or endpoint.

2

Select Tests

Click Run Test and select the tests by name or category.

3

Enable Smart Automated Testing

Check Smart Automated Testing in the test configuration panel.

4

Run

The agent references the selected test definitions and begins the execution loop.

The agent uses the test ID and its associated YAML definition to understand the scenario — what vulnerability to test for, what parameters to manipulate, and what response conditions confirm a finding.

Viewing the AI Execution Trace

Each Smart Automated Testing run produces a detailed AI Execution Trace visible in the test result. See AI Execution Trace in Test Results for details on reading the trace.

Key Differences from Standard Testing

	Standard Testing	Smart Automated Testing
Execution	Fixed payload templates	AI-reasoned, adaptive requests
Attempts	Single pass	Multiple attempts, each improving on the last
Transparency	Request/response logs	Full reasoning trace (Thinking, Plan, Action, Observation)
Validation	Rule-based matchers	AI-driven judgment with evidence

Setup

Smart Automated Testing requires the AI Automated Testing agent running alongside your hybrid testing module. See Set Up Smart Automated Testing for installation and configuration.

Get Support for your Akto setup

There are multiple ways to request support from Akto. We are 24x7 available on the following:

1. In-app intercom support — message us inside the Akto dashboard and someone will reply.

2. Join our discord channel for community support.

3. Contact [e-mail] for email support.

4. Reach us here.