November 5, 2026
Insomnia: an autonomous AI red team that runs a pentest from recon to report
Most companies get a real penetration test once a year, if that. A senior tester spends days on recon and scanning, chains a few exploits…
By Ilya Samarsky
2 min read
Most companies get a real penetration test once a year, if that. A senior tester spends days on recon and scanning, chains a few exploits by hand, and then writes the report. It is slow, it is expensive, and it does not scale.
Insomnia is our attempt to fix that. It is an autonomous AI pentesting suite: you point it at a target and a team of seven AI agents runs the whole engagement on its own, from recon and OSINT to scanning, CVE validation, exploitation and privilege escalation, then hands you a client-ready report.
Watch it in action
- Full 36-minute voiced walkthrough: https://insom.ai/static/video/demos/00-insomnia-full-walkthrough-voiced.mp4
- Short demo of every module (web scanner, OSINT canvas, Active Directory, C2, Report Studio, MCP server and more): https://insom.ai/en/videos
What the AI red team does
The seven agents split an engagement the way a human team would. Recon and OSINT feed targets to the scanners, findings get validated against known CVEs, and the exploitation side tries to prove real impact instead of dumping a list of maybes. Everything ends up in one report with CVSS scores and fixes.
It is also MCP-native, so you can drive a full assessment from an AI assistant in plain language.
What is inside
- 275+ web attack modules: SQLi, XSS, CSRF, JWT, GraphQL and API testing
- 20+ protocol scanners with matching against 30,000+ CVEs
- OSINT with 200+ transforms on a visual canvas
- Active Directory auditing with BloodHound mapping
- Intercepting proxy, fuzzing and out-of-band testing
- Cloud and infrastructure checks
- Command and control for post-exploitation
- Report Studio: one-click PDF, DOCX and HTML reports with CVSS scoring
- CI/CD pipeline builder, plus VS Code and JetBrains plugins
Screenshots
Free SAST CLI
The static analysis engine is free and open. It scans source code for vulnerabilities and leaked secrets, and validates live keys. Install it with pip install sast, npm i -g sastai or docker pull dominators/sast. Source and docs: https://github.com/vulnz/sast
Pricing
- Community Edition: free
- SAST CLI and CI/CD wizard: free
- Advanced: $149 per month
- Pro: $399 per month
- Enterprise: on request
Who it is for
- MSSPs that want continuous testing across their whole client base
- Red teams that need a force multiplier, not another headcount
- Dev and DevSecOps teams that want real security checks in CI
Please only test systems you own or have written permission to test.
Try it: https://insom.ai