Core concepts

The shared mental model behind Rank — how pentests, Rules of Engagement, agents, validated findings, sealed reports, teams and tiers fit together across every product.

The mental model

You describe a target, then authorize it with a machine-readable Rules of Engagement. The RoE is fail-closed: without an active one, the orchestrator will not start. AI agents run the engagement; they produce structured findings (CVSS 4.0, CWE and related taxonomy), not free-text notes. A deterministic validator, isolated from the discovering model, confirms or refutes each finding. You triage what is confirmed, optionally retest a fix, and issue a sealed report.

The same objects exist whether you drive them from the web app, the CLI, the Python SDK or the REST API — only the surface changes.

Two choices shape every engagement: how the pentest is driven (its mode) and where its tools execute (cloud or local).

Guided vs automatic

A pentest runs in one of two modes:

• Guided — you choose the agents for each phase and advance one phase at a time. You stay in the loop between phases, which is ideal for detailed, controlled analysis.
• Automatic — the platform assigns default agents to every phase and chains them end to end with no intervention. Vulnerabilities are processed automatically and the pentest finishes on its own. This is the fastest path to a result.

The mode is fixed when the pentest is created and determines how much you interact with it. See Pentests, assets & phases for how each mode maps onto the phases.

Cloud vs local execution

Agents act through tools, and each tool declares where it can run:

• Cloud — the tool runs on Rank’s infrastructure. Nothing to install; this is the default for the web app and the cloud CLI client.
• Local — the tool runs on your own machine through the CLI, so it can reach internal targets and use software you already have installed.
• Both — the tool supports either location.

The same split applies to MCP servers, which extend an agent with remote tools you host yourself. See Agents, tools & MCP for the details.

Explore the concepts