> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antigen.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Concepts

## Your environment

**Expert**: Every Antigen organization has an expert. Your expert helps plan your pen-testing cadence, approves your testing scope, explains security issues to your team, and is available through Slack or directly in the platform.

**Asset**: A service, resource, or component in your cloud infrastructure, such as an EC2 instance, IAM role, Vercel deployment, or GitHub Action.

**Asset Map**: A graph of your assets and their relationships, kept up to date through read-only integrations with your cloud providers and identity systems.

## Testing your systems

**Target**: A domain or IP address approved for testing. To ensure responsible use, targets must be approved by your expert before an agent can test them.

**Agent**: An AI agent that runs in a secure sandbox, uses our cyber-capable model gateway, and is configured with skills and guardrails. You can build and deploy custom agents through the Agent SDK. For most teams, tCell is the recommended starting point: a general security agent built using the same SDK. tCell is state-of-the-art on several public benchmarks, is trusted by our largest customers, and our team continually improves it.

**Run**: Points an agent at approved targets. Runs produce vulnerabilities and evidence.

## Understanding the results

**Vulnerability**: A security weakness discovered during a run. Includes severity, a description of the issue, and proof that it is exploitable. Each vulnerability has one of five statuses: open, in progress, remediated, verified, or accepted risk.

**Evidence**: The requests, responses, screenshots, and other artifacts that show a vulnerability is real and exploitable.

**Report**: Summarizes an engagement and maps vulnerabilities to compliance frameworks such as HIPAA, PCI DSS, SOC 2, and NIST 800-53.

## Automating the lifecycle

**Hook**: A function that runs when a vulnerability changes state or assignment. Receives the previous and current values, allowing Antigen and your own agents to respond to each transition.

**Triage Agent**: Antigen's built-in agent that assesses new vulnerabilities and decides whether they can be remediated automatically or need someone on your team to take action.

**Remediation Agent**: Antigen's built-in agent that works on vulnerabilities assigned to it. Clones your repository, writes fixes, and opens pull requests. You can replace it with your own coding agent.

## Extending Antigen

**Sandbox**: A secure, isolated environment where an agent runs. Backed by a Firecracker microVM with its own network isolation and encrypted workspace. Sandboxes run on managed Antigen infrastructure or can be self-hosted on your own cloud.

**Skill**: Instructions your team writes to teach an agent about your infrastructure. Loaded through the SDK.

**Guardrail**: A constraint on agent behavior, such as "Stop on critical vulnerabilities" or "Do not test /internal endpoints."

**Steering**: A message sent to a running agent to redirect its focus. Available through the SDK and CLI.