First Tahr blog post.

AI pentest agents can generate findings fast.

The real value comes from testing which ones are actually exploitable.

- SQL injection on parameterized endpoints. - XSS behind a strict CSP. - SSRF on servers with no outbound access.

These kinds of findings can look legitimate in raw output.

EVA re-tests each one independently. If it cannot reproduce the issue, the finding is removed from the report.

The end result is a report built on verified issues and real evidence.