- Access to a cloud account (AWS, Google Cloud, Azure, or Cloudflare) or a code host (GitHub or GitLab). You must be able to connect it.
- At least one domain you are authorized to test.
- (Recommended) A dedicated test login for your application.
1
Connect your first account
Connect a cloud account or a code host. The first scan starts immediately. Results usually arrive within one hour.During the scan, Tolmo builds your knowledge graph. Tolmo also finds your domains, hosts, and applications. For all supported providers, see the integrations catalog.
2
Authorize a domain
Enable offensive testing on a domain that you own. If you have a staging domain, start with it.Safety and authorization explains the scope that you authorize.
3
Add a test account (recommended)
Give the agents a test login. Also give them the notes that they need to reach your app.Without a login, the agents test only the pages that an anonymous visitor can reach. See Define scope.
4
Start your first pentest
Start a Red team run. The run tests all authorized domains. It reports only the issues that it can exploit.
5
Review a validated finding
Open a finding. The finding shows what happened and why it is important. It also shows the request that exploited the issue.See Understand a finding.
6
Fix and retest
Give the fix prompt to your coding agent. Ship the change. Then retest the finding. When the attack fails, Tolmo resolves the finding.See Fix a finding and Retest a fix.
7
Make it continuous
Set a daily or weekly schedule for the Red team agent. Let the Blue team agent validate new findings from your security tools when they arrive.Send notifications to Slack or email. Then you get new findings without opening Tolmo. See Keep up with production changes and Notifications.
Next steps
How the Red team agent tests
The steps of a run, from recon to the verified report.
Validate the findings you already have
Let the Blue team agent prove or disprove your scanner alerts.