One of the latest developments is Burp AT, an agentic AI capability introduced by PortSwigger for Burp Suite Professional users.

What Is Burp Suite?

Burp Suite is a widely used web application security testing platform developed by PortSwigger. It helps penetration testers, ethical hackers and application security professionals investigate vulnerabilities in web applications.

The platform provides several tools that allow security professionals to intercept, inspect, modify and analyze HTTP and HTTPS traffic between a browser and a web server.

Some of its major tools include:

• Proxy: Intercepts and examines HTTP and HTTPS requests and responses.
• Repeater: Allows testers to modify and resend individual requests.
• Intruder: Automates customized request-based testing.
• Scanner: Identifies potential security vulnerabilities in supported configurations and editions.
• Decoder: Encodes and decodes different data formats.
• Comparer: Compares two pieces of data to identify differences.
• Sequencer: Analyzes the randomness and quality of session tokens.

Burp Suite is useful for both manual and automated testing. It gives testers control over application requests and helps them investigate how an application behaves under different conditions.

Official website: https://portswigger.net/burp

What Is Burp AT?

Burp AT is an agentic AI-powered penetration testing capability introduced by PortSwigger in July 2026.

It brings AI agents directly into the Burp Suite Professional workflow. Instead of manually performing every testing step, a security professional can describe a testing goal in natural language and allow Burp AT to plan and carry out parts of the investigation using Burp Suite's existing tools.

For example, a tester may ask it to:

• Investigate an unfamiliar web application.
• Explore a particular part of an application's attack surface.
• Confirm a suspected security vulnerability.
• Reproduce a previously identified issue.
• Investigate a specific vulnerability category.

Burp AT can use the context already available in a Burp project, including relevant traffic, site map information and previously identified issues.

An important difference is that Burp AT does not simply generate suggestions. It can perform multi-step testing actions through Burp's specialist tools, subject to the permissions and scope configured by the tester.

It is currently available in public beta for Burp Suite Professional users.

Official documentation: https://portswigger.net/burp/documentation/desktop/burp-at

Burp Suite vs Burp AT: What Is the Main Difference?

The most important thing to understand is that Burp Suite and Burp AT are not two completely separate competing products.

Burp Suite is the broader web application security testing platform, while Burp AT is an AI agent capability integrated into Burp Suite Professional.

Traditional Burp Suite workflows often involve testers manually selecting tools, configuring requests, reviewing responses and deciding what to investigate next.

Burp AT adds an AI-driven workflow that can plan and execute multiple testing steps using the tools available inside Burp.

The goal of Burp AT is not to remove the penetration tester from the process. It is to help the tester investigate more areas while spending less time on repetitive activities.

Key Features of Burp AT

1. AI-Powered Testing Through Natural Language

One of the most interesting features of Burp AT is its ability to understand testing instructions written in natural language.

Instead of manually deciding every action, a penetration tester can describe the objective.

For example:

"Investigate the authorized application for possible broken access control issues and verify any suspicious findings."

Burp AT can interpret the task, plan the investigation and use the available Burp tools to perform permitted actions.

This makes certain security workflows easier to initiate, particularly when a tester is investigating an unfamiliar application.

2. Uses Existing Burp Suite Tools

Burp AT is built around Burp Suite's existing specialist tools rather than relying entirely on improvised scripts.

This is important because professional penetration testing often involves unusual HTTP behavior, complex request structures, authentication workflows and application-specific functionality.

By using Burp's established tooling, the agent can work within an environment already familiar to professional security testers.

3. Understands Existing Project Context

During a penetration test, a tester may collect hundreds or thousands of HTTP requests, responses, site map entries and vulnerability findings.

Starting every investigation from the beginning would waste valuable time.

Burp AT can use relevant information from the existing Burp project as context.

For example, the tester can provide a request, a site map entry or an existing issue to help the agent understand what needs to be investigated.

This allows the agent to continue working with information already gathered during the security assessment.

4. Configurable Autonomy and Permission Controls

AI agents need clear boundaries, especially when they interact with real applications.

Burp AT provides configurable permissions that allow testers to decide which actions can happen automatically and which require approval.

Depending on the configuration, actions can be:

• Allowed to proceed automatically.
• Paused until the tester approves them.
• Restricted or blocked.

These controls are enforced through Burp's own tooling rather than relying only on instructions given to the AI model.

This is an important security design consideration when using AI agents for penetration testing.

5. Transparent Testing Activity

Another useful feature is visibility into the agent's actions.

Burp AT records its relevant activity in the Burp project. Requests and responses generated during testing are captured in the Logger, allowing testers to review what happened and investigate reported findings.

This is important because a professional penetration testing report must be supported by evidence.

An AI-generated explanation alone is not sufficient proof of a vulnerability.

What Is Burp AI? Is It the Same as Burp AT?

Burp AI and Burp AT are related, but they serve different purposes.

Burp AI provides AI-assisted features within individual Burp tools. It helps testers understand requests, investigate findings and perform specific tasks more efficiently.

For example, Burp AI can help:

• Analyze suspicious HTTP requests in Repeater.
• Explain unfamiliar web technologies.
• Suggest what to investigate next.
• Assist with authentication setup.
• Reduce certain false-positive findings.

Burp AT, on the other hand, brings agentic AI into the testing workflow. It can pursue a broader testing goal by planning and performing multiple actions through Burp's tools.

In simple terms:

• Burp AI: Helps with individual security testing tasks.
• Burp AT: Helps carry out a larger, multi-step investigation.

Both capabilities are designed to support human-led security testing rather than eliminate the need for professional judgment.

How AI Agents Are Changing Web Application Penetration Testing

Traditional penetration testing requires technical knowledge, patience and a structured testing methodology.

AI agents introduce another layer of automation into this process.

1. Faster Initial Application Investigation

Understanding an unfamiliar application can take considerable time.

An AI agent can help explore an authorized target, examine available project context and organize potential areas for further investigation.

This can help testers focus their attention on interesting application functionality instead of spending all their time on initial discovery.

2. Improved Vulnerability Investigation

Automated scanners can identify potential security issues, but some findings require additional investigation.

An AI agent can help follow up on suspicious findings, inspect related requests and responses, and attempt to validate whether a reported issue is genuine.

The final result still needs human verification.

3. Reduced Repetitive Work

Security testers often repeat similar tasks across different application endpoints.

AI agents can help handle certain repetitive investigation steps, allowing professionals to spend more time on complex security problems, business logic and risk assessment.

4. Better Learning Opportunities

Burp AT can also help junior penetration testers understand how an investigation progresses.

They can review the agent's reasoning, inspect the actions taken and ask follow-up questions about the testing methodology.

This can be useful for learning, provided the results are reviewed critically rather than accepted without question.

Example: How Burp AT Can Help Investigate Broken Access Control

Broken access control occurs when an application fails to properly enforce restrictions on what users can access or perform.

For example, an ordinary user may be able to access information or functionality that should only be available to an administrator.

Consider an authorized test application with two accounts:

• User A: Standard user
• User B: Another standard user

A tester may identify an application request that retrieves account information.

With a traditional workflow, the tester manually examines the request, modifies relevant parameters and checks whether the application properly enforces authorization.

With Burp AT, the tester can describe the investigation goal and provide the relevant request or project context.

The agent can then assist with examining the behavior and investigating possible authorization weaknesses using its permitted tools.

A proper validation process should confirm that:

1. The application has an authorization weakness.
2. The response exposes information or functionality that the user should not access.
3. The result is reproducible.
4. The issue has a clear security impact.

This is a useful example of how agentic AI can support an existing penetration testing methodology.

All testing must be performed against applications for which the tester has explicit authorization.

Burp AT Security and Privacy Considerations

Although AI-powered testing offers several advantages, organizations should understand how their information is processed.

Organizations should therefore consider the following precautions:

• Avoid including unnecessary customer information in testing context.
• Do not expose production credentials or private keys.
• Use dedicated test accounts whenever possible.
• Review what information is being shared with AI services.
• Configure tool permissions carefully.
• Require manual approval for sensitive actions.
• Follow internal security and data protection policies.

One particularly important point: Burp AT can send potentially destructive requests if the relevant actions are permitted. High-impact actions require approval, and testers should configure the tool carefully before running it against sensitive environments.

Official reference: https://portswigger.net/burp/documentation/ai-features/trust

Is Burp AT Better Than Traditional Manual Penetration Testing?

It depends on the testing objective.

Burp AT can help with repetitive investigation, initial exploration and certain multi-step testing activities. However, manual penetration testing remains essential for complex business logic, unusual application behavior and high-risk security assessments.

Here is a practical comparison:

The strongest approach is to combine AI assistance with traditional testing expertise.

Limitations of AI-Powered Penetration Testing

AI agents are powerful, but they are not perfect.

Organizations should understand several limitations before relying on them.

False positives: An AI agent may identify suspicious behavior that is not actually exploitable.

Missed vulnerabilities: AI agents cannot guarantee complete coverage of an application's attack surface.

Context limitations: Complex business rules and application-specific requirements may be difficult for an AI system to understand.

Operational risks: Incorrect permissions or poorly controlled automation can result in unintended requests or changes.

Human dependency: Experienced professionals are still required to validate vulnerabilities, understand business impact and prepare reliable reports.

AI should be treated as an additional capability in the security testing process, not as a replacement for professional cybersecurity expertise.

The Future of AI-Powered Web Application Security Testing

The introduction of Burp AT represents an important development in the evolution of penetration testing.

Cybersecurity tools are moving beyond simple automation toward systems that can interpret objectives, plan investigations, use specialized tools and adapt based on their findings.

This shift may change how security teams organize their work.

In the future, AI agents could assist with more complex security assessments, continuous application testing and vulnerability triage. However, their effectiveness will depend on reliable tooling, proper permissions, accurate findings and human oversight.

Conclusion

Burp Suite has been an important tool in web application penetration testing for many years. With the introduction of Burp AT, PortSwigger is bringing agentic AI into this established security testing environment.

However, AI cannot guarantee that an application is secure. Human expertise, proper authorization, evidence-based validation and responsible testing remain essential.

The future of web application security is likely to combine experienced penetration testers, specialized security tools and carefully controlled AI agents.