Sprocket Security provides continuous penetration testing for mid-market and enterprise security teams. Instead of an annual test that is out of date as soon as it is delivered, it tests clients’ networks and applications all year, using a fleet of AI agents for discovery and reconnaissance and human penetration testers for exploitation and validation.
It is aimed at security teams whose attack surface changes faster than a yearly test can keep up with, and who need proof that a finding is real before spending time on it.
At A Glance
| Vendor | Sprocket Security |
|---|---|
| Category | Continuous penetration testing and attack surface management |
| Deployment | Managed testing service with a client portal |
| Agentic AI | AI agent fleet (Apex, Link) supervised by human testers |
| Customers | Citizens Bank, Checkr, Westinghouse, UW Credit Union, Culver’s |
| Memberships | CREST member, FS-ISAC affiliate |
| Market classification | Vulnerability Management |
What Sprocket Security Does
The approach is continuous offensive security. After an initial baseline, testing is triggered by real changes in the client’s attack surface, so findings arrive as risks appear rather than in one report a year. Machines do the repetitive work and people do the judgement: every finding is confirmed with proof of exploitation before the client sees it, and fixes are retested as often as the client needs. Compliance reports for frameworks such as SOC 2, ISO 27001, HIPAA, PCI DSS and HITRUST come from that live testing data.
Products
Continuous Penetration Testing
This is the core service, for teams that need year-round assurance across networks, applications and attack scenarios rather than a snapshot. Each finding comes with a step-by-step attack narrative showing the exploit path, remediation is tracked in real time, and executive, compliance and third-party attestation reports can be produced on demand.
Specialised Testing
Specific engagements cover each part of the attack surface:
| External Penetration Testing | Internet-facing domains, applications, APIs and cloud services |
|---|---|
| Internal Penetration Testing | What an attacker could do after a breach, including lateral movement and privilege escalation |
| Social Engineering | Controlled phishing, vishing and other social engineering campaigns |
| Web Application Testing | Continuous checks of application-layer security |
Attack Surface Management
Attack Surface Management finds a client’s exposed assets automatically, including domains, IP addresses and services. It tracks changes to the external footprint, monitors reconnaissance, prioritises risk and gives each finding context and remediation guidance.
How It Works
Each engagement is split between AI agents and human testers across six phases.
| Component | What it does |
|---|---|
| Discovery | Agents continuously enumerate domains, subdomains, IP ranges, cloud assets and exposed services, while testers validate scope. |
| Reconnaissance | Agents identify technologies, versions, endpoints and authentication surfaces, and testers look for anomalies in that inventory. |
| Authenticated testing | Agents test behind the login while testers examine business logic and privilege boundaries. |
| Exploitation and chaining | Humans lead, confirming exploitability by hand and chaining findings together. |
| Validation and reporting | Agents gather evidence and pre-fill the report, and a human supervises every finding. |
| Retest | Discovery agents keep running so new assets are tested, and testers verify fixes. |
Agentic AI Capabilities
Agent Fleet
Apex runs unauthenticated web application penetration tests and Link runs authenticated ones. “Every agent has a specialty, a boundary it cannot cross, and a human who answers for its output.”
Safety Framework
The published safety framework sets seven properties for every agent: Bounded, Proportionate, Veridical, Contained, Efficient, Transparent and Governable, mapped to the OWASP Autonomous Penetration Testing Standard. In practice, each request is checked against scope, exploitation stops at proof, any data an agent discovers stays in an isolated engagement volume, the audit trail sits where the agent cannot reach it, and anything high-risk waits for human approval.
Company Background
| Headquarters | Madison, Wisconsin, United States. |
|---|---|
| Leadership | Casey Cammilleri, founder and CEO; Guarav Kulkarni, COO. |
| Recognition | Included in the 2025 GigaOm Radar for PTaaS; Global InfoSec Awards 2026; Cyber Security Award 2026. |
Note: This overview is compiled from Sprocket Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.