Yes.
Agent Ops are consumed based on the testing effort required, not on whether vulnerabilities are ultimately identified.
Even when no vulnerabilities are found, sufficient testing is required to validate coverage, confirm behavior, and ensure results are meaningful. This effort still consumes Agent Ops.
💡 Helpful to know
If a test completes with no findings, you may want to review the test configuration and depth:
For web application testing, consider running an authenticated test to allow deeper coverage and validation.
For external network testing, ensure there are no security controls (such as firewalls or access restrictions) preventing RedVeil from communicating with the target IP.
Penetration testing with RedVeil is designed to assess the security of the host or application itself, not to measure the effectiveness of perimeter controls blocking access entirely.