Skip to main content
A pentest shows production on the day of the test. After that day, each deploy adds endpoints, hostnames, and cloud resources that the pentest did not see. Your scanners also continue to send alerts. Tolmo continues to test production as it changes. Thus, you know what an attacker can reach today, and you do not wait for the next yearly pentest.

​
Changes that Tolmo detects

Tolmo builds a knowledge graph of production from the accounts that you connect. For each asset, the graph records when Tolmo first saw it and when Tolmo last saw it. A recent first-seen time shows that an asset is new.

​
Agent reactions and timing

An authorized domain is a domain where an organization admin enabled offensive testing. See Define scope.
Red runs on a schedule or when you start a run. A new endpoint waits for the next scheduled run. Thus, set a schedule that matches how often you ship.

​
Set the Red schedule

The Red schedule sets how often the Red team agent pentests all authorized domains automatically. You set a frequency, a start time, and a timezone:
  • Daily: every N days.
  • Weekly: every N weeks, on one or more weekdays.
You can pause the schedule during a release freeze. Tolmo keeps your settings. When you resume the schedule, automatic runs start again.
If you deploy every day, use a daily schedule. Then the time between a change and its first test is less than one day. After a large release, start a run immediately. Do not wait for the next scheduled run.
To set the schedule from the CLI, use tolmo red-agent schedule:
For all flags, see the red-agent command reference.

​
Start a run now

You can start a run at any time, for example after a large release. To start a run from the CLI, use this command:
A run that you start tests the same authorized domains as a scheduled run. It does not change the time of the next scheduled run.

​
Add Blue triggers for new third-party findings

A Blue trigger sets which new findings from your other security tools Blue tries to exploit. It also sets when Blue starts. For what Blue does with each finding, see Validate the findings you already have. A trigger matches new findings by severity. It can also match by source, such as Wiz or Snyk. A trigger runs in one of two modes:
  • On arrival: Blue starts when a matching finding arrives.
  • On a schedule: Blue starts daily, or weekly on a day that you select.
Start with one trigger that verifies each new critical finding when it arrives. Blue checks the triggers in order and uses the first trigger that matches. A finding that matches no trigger follows your default setting. The default setting is off, daily, or weekly.

​
Limit Blue to testing hours

You can limit Blue to testing hours on the days that you select. Use this setting to keep verification traffic to specified times. Outside the testing hours, no Blue run starts. If a run continues when the testing hours end, Tolmo stops the run. Tolmo starts the run again when the testing hours start again.

​
Get notified about changes

When notifications are on, Tolmo sends a validated finding to Slack when an agent proves it. The finding is also in your next email digest.

​
Next steps

How the Red team agent tests

The steps of a run, from recon to a validated finding.

Define scope

Select the domains that the agents can test, and give the agents test accounts.