XBOW Pentest Manager Agent

XBOW Pentest Manager Agent enables security teams to initiate automated penetration tests directly from Microsoft Security Copilot and manage testing workflows without leaving the Microsoft security environment.

This agent is designed for security operations teams, application security teams, and security engineers who need to validate real exploitability of application vulnerabilities and continuously test their security posture.

The agent orchestrates penetration tests in the XBOW platform and prepares the results for downstream analysis in Microsoft Sentinel and Security Copilot.

Agent tasks

List all applications (assets) in my XBOW organization, list all findings on my application, launch a pentest against my application

Agent workflow

• Input: XBOW Organization ID, Asset ID, Finding ID

• Output: Application asset list, application findings list, pentest execution request, pentest status metadata

Estimated SCU consumption per execution

SCU consumption varies depending on the number of assets queried and the complexity of the request.

• Small environments: ~1 – 1.5 SCUs
  (e.g., querying assets or findings in small environments with limited data)

• Medium environments: ~2 – 3 SCUs
  (e.g., environments with multiple applications and moderate security telemetry)

• Enterprise environments: ~3 – 4 SCUs
  (e.g., large environments with many applications and findings where pentest execution requests involve more processing)