Why XBOW, Horizon3, and Pentera don't test your AI app

Most teams shipping LLM-powered features in 2026 have a security tool named XBOW, Horizon3, or Pentera. None of those products test the AI surface. They were built before this surface existed, and their detection libraries reflect that.

If your product has a chat box, an agent, a RAG layer, or an MCP server in production, an automated pentest that ignores those is a pentest of half your application. This post walks through what each of those platforms covers, what they miss, and where Brektra fits.

What XBOW covers

XBOW is excellent at automated bug-bounty-style web testing. It chains OWASP Top 10 web vulnerabilities, finds IDOR, injection, SSRF, and broken-access patterns, and writes proof-of-impact reports against classic web targets.

What it does not do:

• Probe LLM endpoints with prompt injection variants
• Detect indirect injection in RAG context
• Exercise tool calls and agent decision boundaries
• Check MCP servers for filesystem-traversal or shell exposure
• Walk multi-turn jailbreak gradients

Those are not edge cases. They are the entire AI app pentest surface.

What Horizon3 covers

Horizon3 is built for breach-and-attack-simulation against infrastructure: Active Directory, lateral movement, Kerberoasting, credential reuse, ransomware paths. It is the right tool for an internal AD assessment or a red-team rehearsal of a Windows estate.

It does not test AI applications. Horizon3 assumes the target is a network. The output of an LLM endpoint is opaque to it.

What Pentera covers

Pentera is in the same family as Horizon3. Network-centric breach-and-attack simulation, deeper coverage of OT and ICS in some deployments, and a strong story on safety controls in production networks. Web app and API coverage is present but not the focus.

Like Horizon3, Pentera was built before the AI surface existed. Its attack library does not include LLM01 through LLM10.

Where Brektra fits

Brektra is the autonomous pentest platform built for AI apps first, with web/API/Cloud surfaces in the same engine. Specifically:

• AI app pentest as the default surface. Prompt injection variants, RAG poisoning, tool abuse, agent hijacking, MCP exploitation, and multi-turn jailbreaks ship in the box.
• Web/API/Cloud in the same scan. If your AI app is also a Next.js app on AWS, Brektra covers both halves and chains exploits across surfaces (cloud creds leaked through an LLM tool, for example).
• Replay UI so the customer or auditor sees the exact path the agent took.
• Patch PRs from confirmed findings, with a re-test loop after merge.
• Free tier that lets engineers run a real scan without procurement.

You should still use XBOW for bug-bounty-grade web testing, Horizon3 or Pentera for infrastructure rehearsals. Run Brektra on top for the AI surface. The three categories overlap less than vendors imply.

When to pick which

Further reading on AI app pentesting

The phrase AI app pentest still does not have a fixed meaning across vendors. Some call it AI red teaming, some call it LLM security scanning, some bury it inside a generic application-security product. The underlying work is the same: probe the model, the retrieval layer, the tool and agent surfaces, and the multi-turn conversation envelope, then prove impact in a way that survives a reviewer.

Three concepts to know if you are setting up an internal program:

• Prompt injection testing is more than typing "ignore previous instructions" into a chat box. The hard variants are indirect (delivered through retrieved content), encoded (delivered through base64 or unicode tricks), or multi-turn (delivered across many innocuous-looking turns).
• MCP security is the next layer. Once an agent has tools, the agent's permissions and the tools' input validation are part of the attack surface. A filesystem MCP that accepts ../../../../etc/passwd is a filesystem read primitive in the LLM's hands.
• AI red teaming tool vs LLM security scanner: the first is open-ended exploration with humans in the loop; the second is reproducible automation. You want both. Brektra is the second; we are not a replacement for a human red team, but we are a replacement for the assertion that "we manually red-teamed it once last quarter."

If you are evaluating tools, the Attack Atlas is the easiest way to see what a real AI app pentest looks like in practice. Every pattern is documented and runnable.