External scans only see the outer shell. The paths that matter show up only inside the network: lateral movement, Active Directory escalation and internal services that can be exploited. SecTepe SnapScan covers this with two building blocks. The in-network runner is a Docker image. The hardened appliance is a physical or virtual device. Both are strictly bound to a single engagement.
Bound to One Engagement by a One-Time Token
You enroll a runner into the target network with a one-time token (snap1_…, valid for 24 hours). From that token, the platform builds an HMAC-signed scope document. The runner checks each target against this document locally. It refuses out-of-scope targets on its own.
This is defense in depth: it works even when the control plane can't be reached. A heartbeat with a kill switch makes the runner destroy itself if the link is lost or the engagement ends.
Batteries Included: the AD and Credential Toolkit
For internal tests, the runner ships with a curated tool set. It is unlocked by the allowActiveExploitation switch:
- nmap and nuclei for discovery and template-based checks,
- bloodhound-python to map AD attack paths,
- netexec and impacket to test protocols and credentials,
- Certipy for AD CS abuse,
- Responder and Coercer for coercion and relay scenarios.
So one runner covers the usual internal escalation paths. Testers don't have to build a workbench by hand.
On-Host Agent With a Human in the Loop
The on-host agent adds to this. It runs right on a host inside the customer network. Its control plane keeps a human in the loop, so the scan agent no longer acts fully on its own. Instead, it works through:
- an auto-approval configuration,
- decision logging,
- autonomy reporting.
The console shows a real on-host agent dashboard; the earlier mock is gone. A central tool-pack service adds more tools, such as Metasploit and Nuclei.
For hosts with few resources, there is a "thin executor" mode. You can also ship the agent as a real standalone binary via Node SEA (Single Executable Application). Then the target system needs no Node runtime. A deploy handoff links the agent to auto-follow scans that stay within scope.
Why This Matters for Internal Assessments
The classic way to run an internal pentest is to bring a laptop, set up a VPN and install tools. That is slow, hard to audit and hard to repeat. A signed device that limits itself and has a kill switch is different. You can repeat the test, the record is clean, and you can put the device in a customer's rack without worry. Add the AI pentest agent and active exploitation, and you get a full internal test path from start to end.
Conclusion
With the in-network runner, the hardened appliance and the on-host agent, SnapScan takes the pentest to where the real attack paths are. A signed scope, local rejection and a kill switch keep it under control. That makes internal tests as easy to repeat and audit as an external scan.