What Revelion does¶
Revelion runs penetration tests with AI agents. You define a target and the boundaries to respect; the agents map its attack surface, test it, and report what they could establish, with the evidence behind each finding.
How the work is divided¶
The Revelion platform coordinates. It runs the agents, keeps track of what they have found, and assembles the results you see in the app.
Your execution host runs the tools. The security tools the agents use against your target run in a Docker container on a machine you connect and control. The Revelion daemon links that machine to your organisation and manages the container.
This shapes what an assessment can reach. The container uses Docker's networking on your execution host, so it connects to targets through that host's network, or through a VPN tunnel if you attach a VPN configuration to the mission. An assessment can therefore reach systems that aren't exposed to the internet, as long as they're reachable from inside that container.
What the container can reach isn't always the same as what the host itself can reach. A service that listens only on the host's own loopback address is one example. Docker's networking documentation explains the details.
How a mission works¶
A mission is one scoped assessment. It starts with a lead agent that plans the work and can bring in further agents for specific parts of it.
You can follow a mission while it runs. The mission page shows what the agents are doing, the output of the tools they run, and findings as they're recorded.
What you can test¶
| Target | Example |
|---|---|
| Web Application | A URL, such as https://app.example.invalid |
| IP Address | A host address, such as 192.0.2.10 |
Each mission is either a Web Application assessment or a Network Pentest.
What a finding contains¶
Every finding has a title and a severity. Depending on what the agents established, it can also include:
- a CVSS score, and CWE or CVE references
- a proof of concept and the evidence behind it
- the affected endpoints or systems
- remediation guidance
- whether the finding was validated
What Revelion is not¶
It isn't a signature scanner. Rather than matching responses against known patterns, the agents try to establish what is actually exploitable, and record how they got there.
Nor does it replace every kind of human-led test. Where an engagement needs a named tester and a signed report, that remains a human exercise, which Revelion's findings can support.