Rune - Your Always-Available Penetration Testing Consultant

Penetration testing often raises as many questions as it answers.

Teams want to understand what a test is doing, why certain behavior occurred, whether a finding is serious, and what to do next. Traditionally, those answers come from scheduled calls, follow-up emails, or waiting for a consultant to be available.

Rune exists to remove that friction.

Rune is RedVeil’s built-in penetration testing consultant, designed to provide continuous, context-aware guidance throughout the entire testing lifecycle. Rune helps customers understand what is happening during a test, interpret results once testing is complete, and make informed decisions about remediation and next steps.

Rune is not a chatbot layered on top of testing. It is deeply integrated into the platform and designed to behave like a knowledgeable consultant who is always available when questions arise.

Unlike traditional consulting models, Rune is available during testing, not just after it completes.

As a test runs, Rune can help explain:

This real-time guidance helps teams understand the testing process as it unfolds rather than waiting for a report to explain everything after the fact.

Rune’s role is to reduce uncertainty and help teams stay oriented, especially during longer or more complex tests.

One of Rune’s most important capabilities is availability.

Human consultants are constrained by schedules, time zones, and engagement limits. Rune does not have those constraints. Guidance is available whenever questions arise - whether that’s during testing, while reviewing results, or when revisiting a report weeks later.

This makes Rune especially valuable for:

Rune provides immediate access to explanations and guidance without the delays inherent in traditional consulting workflows.

Rune’s guidance is grounded in the specific test you are running or reviewing.

Because Rune is integrated directly into the platform, it understands the scope and configuration of the test, whether testing was authenticated or unauthenticated, what behaviors were observed during execution, and which findings were identified and validated.

This context allows Rune to provide explanations that are specific and relevant, rather than generic advice.

For example, Rune can explain why two tests with similar scope produced different results, why a test consumed a certain amount of Agent Ops, or why additional testing depth may have been applied to a particular area. It can also expound upon remediation steps and find more information regarding a particular vulnerability if a customer needs more detail.

Rune is designed to go beyond simply restating what is already written in a report.

For each identified vulnerability, Rune can help explain things such as:

This deeper explanation helps teams understand not just what was found, but why it matters. This is especially valuable for developers and stakeholders who may not work with penetration testing results on a regular basis.

Rune’s explanations are intended to be educational, not alarmist, and to provide clarity rather than overwhelm.

Identifying a vulnerability is only part of the process. Knowing what to do next is often the harder part.

Rune assists by providing guidance on remediation approaches, common mitigation strategies, and best practices relevant to the type of issue identified. This helps teams move from discovery to action more efficiently.

Rune can also help teams decide:

By guiding next steps, Rune helps ensure that testing results lead to meaningful improvement rather than stalled remediation.

Rune’s value extends beyond individual tests.

Over time, Rune helps teams develop a stronger understanding of how their environment behaves under testing, how changes affect results, and how to structure future tests more effectively.

This includes guidance around:

Rune acts as a continuous source of insight as security programs mature and evolve.

Rune is designed to augment human expertise, not replace it.

While Rune can provide deep explanations, context, and guidance, it does not override human judgment or organizational decision-making. For organizations that require human validation or formal attestation, Rune complements those workflows rather than attempting to replace them.

Rune helps teams ask better questions, understand results more clearly, and engage more effectively with human reviewers or auditors when required.

Rune is intentionally designed as a consultant, not a control interface for testing.

Rune does not directly interact with or influence the AI agents performing penetration testing. The testing agents operate independently based on defined scope, configuration, and internal safeguards. Rune cannot change test behavior, modify scope, adjust testing depth, or execute actions against customer targets.

The only direct action Rune can perform is generating reports from completed penetration tests when requested within the chat interface.

To understand Rune’s role, it helps to think of RedVeil’s system as two clearly separated components:

This separation mirrors how traditional penetration testing works: a tester performs the assessment, while a consultant or reviewer helps explain results, answer questions, and guide next steps.

By preventing Rune from directly controlling testing behavior, RedVeil ensures:

Rune’s guidance is strictly read-only with respect to test execution, ensuring that conversational interaction cannot be used as a control channel.

Transparency is a core design principle for Rune.

Guidance provided by Rune is grounded in observable testing behavior and documented results. Rune does not obscure findings, minimize risk, or reinterpret results in a way that hides important context.

This transparency helps ensure that teams can trust the guidance they receive and understand how it connects back to the underlying test.

Rune is RedVeil’s always-available penetration testing consultant, embedded directly into the platform to provide context, clarity, and guidance throughout the testing lifecycle.

By offering real-time explanations, deep vulnerability insight, remediation guidance, and continuous availability, Rune helps teams get more value from every test - without the delays and constraints of traditional consulting models.

Rune exists to make penetration testing more understandable, more actionable, and more accessible, while still respecting the role of human expertise and layered security programs.