# Casco

> Casco is an AI penetration testing platform that continuously tests web applications, APIs, cloud infrastructure, mobile applications, AI systems, and networks. Its agents map approved targets, prove exploitable paths with reproducible evidence, and retest fixes. Optional security-engineer review is available through Casco Supervised.

Casco operates only within approved scope, identities, time windows, and rules of engagement. It does not perform denial-of-service or resource-exhaustion attacks. Use the product and solution pages below for current capabilities, scope, and access requirements.

## Start here

- [Casco homepage](https://casco.com/): Overview of the continuous AI penetration testing platform, exploit evidence, and automated retesting.
- [Solutions](https://casco.com/solutions): Index of supported targets and testing options.
- [AI pentesting](https://casco.com/solutions/ai-pentesting): How Casco agents explore approved systems, adapt tests to responses, reproduce findings, and retest fixes.
- [Casco Supervised](https://casco.com/supervised): Agent-led penetration testing with review by a security engineer.
- [Enterprise](https://casco.com/enterprise): Enterprise deployment, governance, integrations, and support.
- [Book a pentest](https://casco.com/book): Request a demo or scope a penetration test.

## Testing coverage

- [Web application pentesting](https://casco.com/solutions/web-application-pentesting): Logged-in workflows, roles, tenant boundaries, business logic, APIs, WebSockets, sessions, and file processing.
- [API pentesting](https://casco.com/solutions/api-pentesting): REST and GraphQL endpoints, identities, authorization boundaries, data access, and stateful request sequences.
- [Cloud pentesting](https://casco.com/solutions/cloud-pentesting): Approved public and private cloud assets, IAM, storage, services, and network paths.
- [Mobile application pentesting](https://casco.com/solutions/mobile-app-pentesting): Mobile workflows, application behavior, and backend services within the agreed build and scope.
- [AI application and agent security](https://casco.com/solutions/ai-agent-security): Prompts, tools, permissions, data, RAG pipelines, agents, and MCP components.
- [Network pentesting](https://casco.com/solutions/network-pentesting): Approved external networks and internal targets reachable through a Casco agent in the customer environment.

## Platform capabilities

- [Autonomous pentesting](https://casco.com/solutions/ai-pentesting): Agent-led testing that adapts to the target and preserves reproducible finding evidence.
- [Email Triage](https://casco.com/features/email-triage): Security email triage and workflow automation.
- [MCP Workflows](https://casco.com/features/mcp): Model Context Protocol workflows for connecting security operations and tools.
- [Context Refinement](https://casco.com/features/context-refinement): Target context management for more relevant agent testing.
- [Slack Bot](https://casco.com/features/slack-bot): Security findings and workflows in Slack.
- [Network Observability](https://casco.com/features/network-observability): Visibility into network activity during approved testing.
- [Continuous pentesting](https://casco.com/continuous-pentesting): Ongoing testing and retesting as the product changes.
- [Reproduce and fix](https://casco.com/continuous-pentesting/reproduce-and-fix): Reproducible evidence, remediation context, and fix verification.

## Research and resources

- [Security research](https://casco.com/blog): Product security research, vulnerability disclosures, customer stories, and practical pentesting guidance.
- [Sample pentest report](https://casco.com/?sample-report=1#procurement): Book a walkthrough of Casco's sample pentest report, finding evidence, and remediation guidance.
- [CrewAI customer story](https://casco.com/blog/customer-crewai): How CrewAI uses Casco for AI agent security testing.
- [AI agent security research](https://casco.com/blog/we-hacked-ycombinator-agents): Research into exploitable behavior in AI agents.
- [ElectricSQL vulnerability disclosure](https://casco.com/blog/electricsql-order-by-sql-injection): A reproduced web API vulnerability and disclosure.
- [The five levels of penetration testing](https://casco.com/blog/dont-get-scammed-by-your-pentester-the-5-levels-of-pentesting): A framework for comparing pentest depth and evidence.
- [High-quality pentest reports](https://casco.com/blog/what-is-a-high-quality-penetration-test): Guidance on finding evidence, remediation, and retest reports.
- [CREST accreditation](https://casco.com/blog/crest-penetration-testing-approval): Information about Casco's CREST penetration testing accreditation.
- [Handbook](https://casco.com/handbook): Public company handbook and operating principles.
- [Support](https://casco.com/support): Product support information.
- [Trust Center](https://trust.casco.com/): Security, privacy, and compliance documentation.

## Optional

- [Newsletter](https://casco.com/newsletter): Security research and product updates by email.
- [Partners](https://casco.com/partners): Casco partner program.
- [Careers](https://casco.com/careers): Open roles and company information.
- [CVSS calculator](https://casco.com/tools/cvss-calculator): Interactive CVSS scoring tool.
- [Bug bounty calculator](https://casco.com/tools/bug-bounty-calculator): Interactive bug bounty reward estimator.
- [Privacy policy](https://casco.com/privacy): Privacy terms for the website and services.
- [Terms of service](https://casco.com/terms): Terms governing use of Casco services.