Book a demo

BATTLETEST ENTERPRISE

AI security testing.
In your infrastructure.

Review code changes and test running web applications and APIs with BattleTest AI. Engineers and security engineers can investigate together in the Room. All included in one self-hosted deployment.

Book a demo See what’s included

Self-hosted · Your choice of models · Perpetual licence

Watch the walkthrough 2:12
SELF-HOSTED
Code review

Security findings on pull and merge requests.
Live application testing

AI tests your web applications and APIs.
The Room

Your team and AI investigate together.
Your infrastructure · Your storage · Your model endpoints
01 / CODE AND APPLICATION SECURITY

Review code changes.
Test running applications.

Give engineers security findings in pull requests. Test the running application for issues in access controls and workflows that need to be checked against its behaviour.

Self-hosted code review

Analyse code changes for security issues and return findings to the pull or merge request, where engineers can act on them. Connect GitHub or GitLab, including your own hosted instance.

Code changeAI reviewReview comments
GitHub setup GitLab setup

Live application testing

Test authorised web applications and APIs for weaknesses in access controls and application behaviour. Inspect the requests, responses and reproduction steps behind a finding.

Watch an application test
Inside a live application test
  1. Discovery

    Map permitted routes using the test accounts you provide.

  2. Fingerprint

    Identify services, frameworks and versions to guide testing.

  3. Recon

    Inspect endpoints, account roles and exposed functionality.

  4. Testing

    Probe inputs, access controls and workflows within the agreed scope.

  5. Verification

    Recheck findings and capture requests and responses for reproduction.

02 / ENGINEERING AND SECURITY IN ONE ROOM

Investigate together.
Steer the next test.

Bring the engineers who know the application into the security investigation. In the Room, they can explain expected behaviour while security engineers direct the AI and inspect the same evidence.

  • Add application context. Explain a recent change or how a workflow should behave.
  • Direct the AI. Operators can focus testing on a workflow, exclude an area or pause the run.
  • Work through findings. Ask the AI about its observations and inspect the evidence needed to reproduce the issue.
Explore the Room
The RoomExample run
MAMayaEngineer

We moved billing onto the shared invoice API last release.

ALAlexSecurity engineer

/focus /api/invoices — check access between accounts

@battletestBattleTestAI
HIGH Finding

Invoice accessible from another account

I repeated the request with Northstar’s session. The API returned Juniper’s invoice with HTTP 200.

Inspect evidence and reproduction steps
  1. Sign in to Juniper and open invoice inv_2048.
  2. Request the same invoice using Northstar’s signed-in session.
  3. The API returns Juniper’s invoice instead of denying access.
REQUEST · NORTHSTAR SESSION
GET https://wonderland.drreamer.digital/api/invoices/inv_2048
Authorization: [REDACTED]
RESPONSE · HTTP 200
{
  "id": "inv_2048",
  "account_id": "account_b",
  "account_name": "Juniper",
  "currency": "USD",
  "total_cents": 24900,
  "status": "paid"
}
SUGGESTED CORRECTION

Enforce invoice ownership on the server before returning the document. Add a cross-account access test.

View the full finding
See the full investigation
03 / YOUR DEPLOYMENT AND DATA

Choose where
model requests go.

Run models inside your environment or connect an approved external endpoint. That choice determines where code excerpts and application data sent to the model are processed.

YOUR ENVIRONMENT
Applications
& repositoriesPermitted targets
BattleTestCode review · live tests · Room
Your storageRun records & evidence
Local model endpointsModel requests stay inside your environment

For an offline deployment, model endpoints and required reference data must be available locally. Configure other integrations and network access to match.

Network and egress details
04 / ACCESS AND TESTING PERMISSIONS

Access and
testing permissions.

Room accessExample
Company identity provider

OIDC single sign-on

A
AlexDirect the investigation
Operator
M
MayaFollow the run and discuss findings
Viewer
Identity configuration
05 / OPERATING RESPONSIBILITIES

Deployment and
support responsibilities.

StageYour organisationBattleTest
Set up

Infrastructure, identity, model endpoints and network access.

Deployment documentation; assistance with the optional support plan.

Operate

Testing scope, run permissions, supervision and findings review.

Code review, application testing, the Room and reporting tools.

Maintain

Backups, monitoring and installation of approved updates.

Product updates, feeds and support while the annual plan is active.

PERPETUAL SOFTWARE LICENCE

Licence and
operating costs.

Purchase a perpetual software licence, with optional annual support and updates. Budget separately for infrastructure and model usage.

See full pricing
BattleTest Enterprise$10,000 one time

Perpetual self-hosted software licence.

Priority Support & Product Access

Support, updates and feeds while active.

$3,500/ year · optional

SEE BATTLETEST ENTERPRISE

See the product.
Discuss your deployment.

Book a demo