Web applications are a major attack surface today, and traditional pentests struggle to keep pace with rapid development cycles. In this talk, we’ll explore how agent-driven automation can be used to test modern web applications by mapping behaviour, probing exposed endpoints, and attempting realistic attack paths - uncovering vulnerabilities that typically require manual analysis.