Quick Start

Get from signup to your first vulnerability in five minutes.

Connect your infrastructure

Go to Settings → Integrations and connect your cloud provider. Start with AWS. Antigen creates a read-only IAM role that discovers your services, network topology, and security configuration.This builds your Asset Map, which the agent uses to reason about attack paths across your architecture rather than scanning endpoints blindly.You can skip this step and come back later. The agent will still work through external reconnaissance, but connecting your infrastructure first gives it a more complete picture of your attack surface.

Submit your targets

Go to Settings → Targets and add the domains you want tested.

example.com
*.example.com
api.example.com

To ensure responsible use, all targets require approval from your Antigen security expert before testing can begin. For your first run, we approve targets within minutes during business hours.

Run your first pen test

Once your targets are approved, your Antigen security expert will schedule your first engagement. Every run executes inside a hardware-isolated Firecracker microVM using cyber-capable models developed through our partnership with Anthropic. You will see results appear on the Vulnerabilities page as the agent works.If you use the SDK, you can also start a run programmatically:

npm install @antigen/sdk

import Antigen from "@antigen/sdk";

const antigen = new Antigen(process.env.ANTIGEN_API_KEY);
const targets = await antigen.getApprovedTargets();

const agent = antigen.agent({
  model: "claude-sonnet-4-6",
  guardrails: "Stop on critical vulnerabilities.",
});

const run = await agent.run(targets);

for await (const event of run) {
  if (event.type === "finding") {
    console.log(`[${event.severity}] ${event.title}`);
  }
}

Review your vulnerabilities

Open the Vulnerabilities page. Each vulnerability includes:

Severity: critical, high, medium, or low
A description of the issue
Proof: the exact requests and responses that demonstrate it
A recommended fix

If automated remediation is available, you will see a pull request linked to the vulnerability. Review it, merge it, and Antigen re-tests to confirm the fix worked.

Next steps

Skills to teach the agent about your specific infrastructure
SDK overview to run agents programmatically
Integrations to connect Slack, GitHub, Linear, and more

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

Security

Next steps

​Next steps

Next steps