Insomnia: an autonomous AI red team that runs a pentest from recon to report

Insomnia — Thu, 05 Nov 2026 15:12:05 +0000

Most companies get a real penetration test once a year, if that. A senior tester spends days on recon and scanning, chains a few exploits by hand, and then writes the report. It is slow, it is expensive, and it does not scale.

Insomnia is our attempt to fix that. It is an autonomous AI pentesting suite: you point it at a target and a team of seven AI agents runs the whole engagement on its own, from recon and OSINT to scanning, CVE validation, exploitation and privilege escalation, then hands you a client-ready report.

Watch it in action

Full 36-minute voiced walkthrough: https://insom.ai/static/video/demos/00-insomnia-full-walkthrough-voiced.mp4
Short demo of every module (web scanner, OSINT canvas, Active Directory, C2, Report Studio, MCP server and more): https://insom.ai/en/videos

What the AI red team does

The seven agents split an engagement the way a human team would. Recon and OSINT feed targets to the scanners, findings get validated against known CVEs, and the exploitation side tries to prove real impact instead of dumping a list of maybes. Everything ends up in one report with CVSS scores and fixes.

It is also MCP-native, so you can drive a full assessment from an AI assistant in plain language.

What is inside

275+ web attack modules: SQLi, XSS, CSRF, JWT, GraphQL and API testing
20+ protocol scanners with matching against 30,000+ CVEs
OSINT with 200+ transforms on a visual canvas
Active Directory auditing with BloodHound mapping
Intercepting proxy, fuzzing and out-of-band testing
Cloud and infrastructure checks
Command and control for post-exploitation
Report Studio: one-click PDF, DOCX and HTML reports with CVSS scoring
CI/CD pipeline builder, plus VS Code and JetBrains plugins

Screenshots

Dashboard and live scanning across 275+ modules

Intercepting proxy and OSINT reconnaissance

Exploitation arsenal and payload configuration

Active Directory attacks with BloodHound mapping

Cloud and infrastructure security testing

Command and control with post-exploitation

Reporting and knowledge base

Network utilities

Free SAST CLI

The static analysis engine is free and open. It scans source code for vulnerabilities and leaked secrets, and validates live keys.

pip install sast
npm i -g sastai
docker pull dominators/sast

Source and docs: https://github.com/vulnz/sast

Pricing

Plan	Price
Community Edition	Free
SAST CLI and CI/CD wizard	Free
Advanced	$149/month
Pro	$399/month
Enterprise	On request

Who it is for

MSSPs that want continuous testing across their whole client base
Red teams that need a force multiplier, not another headcount
Dev and DevSecOps teams that want real security checks in CI

Please only test systems you own or have written permission to test.

Try it: https://insom.ai

We would love feedback from people who run pentests for a living. What would you want an autonomous red team to never do on its own?

DEV Community: Insomnia