External scans only see the outer skin. The interesting paths – lateral movement, Active Directory escalation, exploitable internal services – only reveal themselves inside the network. That is exactly what SecTepe SnapScan addresses with two building blocks: the in-network runner as a Docker image and the hardened appliance as a physical or virtual device, both strictly bound to a single engagement.
Engagement-Bound via One-Time Token
A runner is enrolled into the target network via a one-time token (snap1_…, valid for 24 hours). From the token the platform derives an HMAC-signed scope document. The runner checks incoming targets locally against this document and refuses out-of-scope targets on its own – defense in depth that does not depend on the control plane being reachable. A heartbeat with a kill switch ensures the runner self-destructs if the connection is lost or the engagement ends.
Batteries Included: the AD and Credential Toolkit
For internal tests the runner ships a curated tool set that is unlocked behind the allowActiveExploitation switch:
- nmap and nuclei for discovery and template-based checks,
- bloodhound-python for analyzing AD attack paths,
- netexec and impacket for protocol and credential testing,
- Certipy for AD CS abuse,
- Responder and Coercer for coercion and relay scenarios.
A single runner thus covers the typical internal escalation paths without testers manually setting up a workbench.
On-Host Agent With Human-in-the-Loop
Complementing this is the on-host agent, which runs directly on a host inside the customer network – with a control plane that keeps a human in the loop: the scan agent no longer acts fully autonomously, but via an auto-approval configuration, decision logging, and autonomy reporting. The console shows a real on-host agent dashboard (the earlier mock is gone), and a centralized tool-pack service provides additional tooling such as Metasploit and Nuclei.
For constrained hosts there is a "thin executor" mode, and the agent can be delivered as a real standalone binary via Node SEA (Single Executable Application) – no Node runtime setup required on the target system. A deploy handoff wires the agent to scope-gated auto-follow scans.
Why This Makes the Difference for Internal Assessments
The classic route for internal pentesting – bring a laptop, set up a VPN, install tools – is slow, poorly auditable, and hard to repeat. A signed, self-limiting device with a kill switch is reproducible, cleanly documented, and can be placed in a customer's rack without worry. Together with the AI pentest agent and active exploitation, this creates an end-to-end internal test path.
Conclusion
With the in-network runner, hardened appliance, and on-host agent, SnapScan brings the pentest to where the real attack paths are – controlled by a signed scope, local rejection, and a kill switch. Internal tests thus become as repeatable and auditable as an external scan.