How to fix security problems with AI agents: guide for SMBs
Solving security problems with AI agents means: a specialist agent reviews what is reachable from the outside of your business, looks for outdated software and open access points, ranks every finding by actual risk, and turns it into clear next steps together with you. At SMarTrAgents these agents are called SMarTrPenTester and SMarTrITGott, they are two of the nine specialist agents that come with the cloud, and they need no separate project.
Somewhere in your business runs software that nobody understands anymore. An admin access point from the previous service provider. A test page nobody ever asked about. A server, set up two years ago and never touched since. Attackers start exactly at those points, and in most small and mid-sized companies nobody looks there, because there is no dedicated security department.
This article shows how AI agents take on that work: how SMarTrPenTester maps the attack surface of your business, how SMarTrITGott turns every finding into technical steps, what it costs, and where the agents deliberately stop. It is written for companies without their own IT department, whose website, mailbox and servers are part of everyday business.
What does IT security with AI agents mean?
An AI agent for IT security is software that methodically reviews your systems and explains the results in plain language. The difference from a scanning tool is not the technology, it is the ranking: after a scan, a tool produces hundreds of alerts, and every one of them looks urgent. The agent tells you which finding comes first, why it is dangerous and what to do next. He works in the same workspace as your other agents, remembers what you discussed last time, and files his result as a document you can download and forward.
| Scanning tool | AI agent (SMarTrPenTester and SMarTrITGott) | |
|---|---|---|
| Findings | a long list, all urgent | a ranked list by actual risk |
| Explanation | abbreviations for specialists | plain language with reasons |
| Next steps | none | a concrete order of who does what |
| Follow-up | the report sits somewhere | in the workspace, on the same file |
What makes an AI agent different from a chatbot in general is explained in What are AI agents. Why we let our own platform be attacked from the outside is described in AI against AI.
Why are small and mid-sized companies popular targets?
Because there, protection rests on specialists a small company cannot afford to hire full time: one for security reviews, one for operations and logs, someone who connects the two. Attackers know this pattern and work through the easy middle: the company with the website from a page builder, the old admin system a former intern set up, the service account for the delivery tool that was never closed again.
On top of that comes the software gap: the loudest warnings on the internet rarely affect software you bought yourself, they affect building blocks that sit inside many products without you naming them. A current example: in two vulnerabilities in the PHP core, known under the name PHP2Shell, security researchers found a way to run code on someone else’s server without logging in. Both flaws carry the highest rating of 9.2 out of 10 on the usual risk scale. The German Federal Office for Information Security calls for immediate updates, exploitation attempts are documented. According to the researchers’ estimate, PHP runs on around 70 percent of the websites on the internet, and many of the companies using it do not even know, because it hides in an admin system or a customer portal.
That is exactly why the inventory check comes first: whoever knows what runs in their business can say within minutes after every warning whether and where they are affected. Whoever does not know starts from zero with every warning.
How does the agent find the security gaps in your systems?
SMarTrPenTester works through the review in a fixed sequence:
- Inventory: You describe to her what belongs to your business: website, mailbox, access to online services, a server, a customer portal. She asks back until the list is complete.
- The view from outside: She goes through what of it is reachable from the internet: forgotten test pages, old subdomains, admin access points still from the previous service provider, software whose version is no longer maintained.
- Ranking instead of alarm lists: For every finding she explains which gap can actually be exploited and which stays theoretical, and why she rates it that way.
- Explanation in plain language: You get no abbreviation soup. If she says your contact form accepts input unchecked, she also explains what somebody could do with it and what a proper check looks like.
- Handover: The result lands as an ordered document in your workspace, so you can download it, forward it to your service provider and continue later at the same spot.
What that looks like in practice
At SMarTrAgents, SMarTrPenTester regularly works in a separated training environment modeled on Hack The Box: her own network, her own container, with no connection to your things and to those of the other customers. She receives a target that was created only for that exercise and works through it autonomously: port scan, path into the system, find, log. Across five training systems, the find ended up in the log: from anonymous file access over a database that hands out its stored entries without login, to a search mask that accepted unvalidated input. Per target the agent needed around 45 own steps from the first scan to the proof of the find, and there was not a single attempt to leave the boundaries of the exercise.
This training has a real reason: whoever carries tools that can look into foreign networks must prove that exactly this does not happen. That is why the same rule applies to our agent as to a real pentester: only the target named in the order, only the own separated network, a log for every step, and the findings land as a document, not as an alarm in the mailbox.
How does SMarTrITGott help with fixing the findings?
A finding alone changes nothing. It gets fixed when somebody knows the cause and in which order the steps must follow. That is where the second agent works:
| Who | What |
|---|---|
| SMarTrPenTester | finds and ranks: what is reachable, where the gaps are, what comes first |
| SMarTrITGott | translates: cause, order, the spots you can check yourself |
| SMarTrCeo | turns it into a decision paper when spending money is required |
| You and your team | decide and implement, or hand it over to your service provider |
In everyday work, SMarTrITGott reads the things that otherwise mean hours of scrolling: he translates error messages, works through log files and tells you when something happened and what preceded it. He goes through setups with you, from server configuration over access rights to the certificates of your website, and writes down the order in which to tackle them. So when you do need a service provider, you arrive with a clean problem description instead of a call that starts with “nothing works”. That makes the conversation shorter and often cheaper.
Both agents work in the same workspace on the same case: what SMarTrPenTester finds, SMarTrITGott understands without you pasting it again. What SMarTrITGott works out, SMarTrCeo sees whenever it needs a business decision. How the memory of this teamwork works is described in The memory of the agents.
What does IT security with AI agents cost?
SMarTrPenTester and SMarTrITGott are not add-on products: they belong to the nine specialist agents and are included in both sizes of the cloud.
| Plan | Price per month | Price per year | Tokens per month |
|---|---|---|---|
| Cloud Starter | €25.99 | €259.90 | 5 million |
| Cloud Professional | €36.99 | €369.90 | 10 million |
The first inventory review described above needs no separate invoice: you describe the status, the agent works through it, the result exists as a document. The price covers the repeated reviews as well: it is the same way of working as with your content agent or your marketing agent, only on the subject of IT security. The current price list is on the prices of the AI agents. All amounts are final prices; as a small business owner under § 19 of the German VAT law we do not charge VAT.
How fast is a warning like this answered?
In the PHP2Shell situation, our first question was: which systems in our platform run PHP at all? The answer came within minutes, because the inventory is in good order: one container per customer, clearly named images, no hidden installations. The result: no PHP in the estate. Not because the review is hard, but because it is prepared. That is exactly the benefit for your company: at the next warning, the answer to “does it affect us?” comes in minutes instead of days.
Where do the agents deliberately stop?
- SMarTrPenTester touches only the target named in the order. Targets of third parties that were not authorized stay untouched.
- Changes on your systems are made only with your approval, step by step and documented.
- Nothing runs fully autonomously across many targets with us: one order, one target, one log.
- The agents do not build panic: a finding is a document with ranking, not a roundmail to your inbox.
How to start your first review
- Open the SMarTrPenTester page and read how she works. Next to it, SMarTrITGott describes his part of the work.
- Open the contact form and describe briefly what belongs to your business and what worries you. Your request becomes a ticket and a mail to our team.
- We reply with a proposal: first the inventory, then the review, then the ranked list. If you want to try it yourself first, there is the test access for companies without payment details.
Our principle throughout remains: human with machine beats human and machine. The agent does the work that eats time: collecting, ranking, working through logs. The decision on what your business finally does is made by a human, with prepared documents instead of panic.
Frequently asked questions
What exactly does an AI pentester do?
He reviews what of your business is reachable from the internet: public pages, admin access points, old test pages, software whose version is no longer maintained. He ranks every finding by actual risk and files the result as a document in your workspace.
Can the AI agent also fix the gaps directly?
Agents change on your systems only what you approve. In everyday work: SMarTrPenTester finds and ranks, SMarTrITGott translates into steps and order, and the implementation runs with your approval or goes to your service provider with a clean list.
What does IT security with AI agents cost?
Both agents are included in both cloud sizes: Cloud Starter from €25.99 per month with 5 million tokens, Cloud Professional from €36.99 with 10 million tokens. There is no setup fee.
Does this replace my IT service provider?
No, and that is its strength: the agent delivers the ranked review and the list. Your service provider implements faster at the end, because they do not get a “nothing works” call, they get a list with findings, ranking and order.
How safe is it to set an agent loose on security?
Our rules for that are strict: only the target named in the order, an own separated network with an outgoing firewall, a log for every step, no full autonomy across many targets. In our training runs there was not a single attempt to leave these boundaries.
Is the review with AI agents GDPR compliant?
The processes of the cloud run on servers in the EU, every customer works in an own container, and for handling your data there is a data processing agreement according to Art. 28 GDPR on request. The details are on AI agents and GDPR.
This post was created by our AI agents on behalf of the owner and reviewed by a human before publication.
Security: SMarTrPenTester
The security agent probes the attack surface of your business and ranks every finding by real exploitability.