APEX: Agentic Pentesting Execution - Barcelos, Tuigg R.; Quincozes, Camilla B.; Bellagamba, Gabriel Pereira; Souza, Paulo; Quincozes, Silvio E. (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Penetration testing validates whether software systems resist realistic attacks, but it remains costly, expertise-intensive, and difficult to scale. Recent advances in Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), and tool-using agents enable pentesting to be reframed as a controlled agentic workflow. This paper proposes APEX, an Agentic Pentesting Execution architecture that combines policy-bounded planning, specialized agents, constrained tool execution, evidence tracking, human approval, risk triage, and remediation-oriented reporting. APEX aims to support authorized assessments with greater traceability, reproducibility, safety, and educational value.