> ## Documentation Index > Fetch the complete documentation index at: https://docs.perfai.ai/llms.txt > Use this file to discover all available pages before exploring further. # Introduction > Perfai Security autonomously detects broken access controls across every role, workflow, and API endpoint in your application — before attackers do. ## What is Perfai Security? Perfai Security is an autonomous application security platform that maps every UI workflow, API endpoint, and user role in your app, then systematically tests all permission combinations to surface broken access controls. Where manual pen testing covers a fraction of your attack surface, Perfai covers it entirely — automatically. ## The Problem Broken access controls are the **#1 risk on the OWASP Top 10** and affect **100% of applications** with more than one user role. They are consistently the most common, most impactful, and hardest-to-find vulnerability class in modern web applications. Traditional security approaches fall short: * **Manual pen testing** is slow, expensive, and covers only a narrow slice of your attack surface * **Static analysis tools** can't reason about runtime permission behavior * **DAST scanners** test URLs and inputs, but miss role-based access logic entirely * **Role matrix spreadsheets** go stale the moment your app changes The result: critical privilege escalation, IDOR, and horizontal access vulnerabilities slip through to production — and into the hands of attackers (or bug bounty hunters). ## How Perfai Works Perfai uses two coordinated AI agents that work together to fully map and then systematically break your application's permission model. The Vision Agent navigates your application like a real user. It discovers and documents: * **UI Workflows** — every screen, action, and user journey (up to 60 per app) * **API Endpoints** — every backend call triggered by those workflows (up to 130 per app) * **Data Ownership** — which data objects belong to which users and roles No integration, no code instrumentation, no browser plugins required. Just your app URL. The Security Agent takes the map built by the Vision Agent and tests it exhaustively across every role combination: ``` 60 UI Workflows × 130 API Endpoints × 6 Roles = 20,000+ permission tests ``` It checks for privilege escalation, IDOR, horizontal access bypass, unauthenticated access, and broken object-level authorization — fully automated. Every finding is surfaced with full reproduction steps, the affected endpoint, the role that triggered it, the expected vs. actual behavior, and a severity rating. Export a compliance-ready report in one click. ## Who Is Perfai For? Catch access control bugs before they leave your machine. Perfai integrates into your development workflow and gives you a security test suite that runs as fast as your app changes. Replace slow manual testing with continuous, automated coverage. Get a full attack surface map and reproducible findings — not just a list of URLs. Go deep on broken access control — the vulnerability class most scanners miss. Perfai is purpose-built for BOLA, IDOR, privilege escalation, and role-based authorization failures. Generate audit-ready reports mapped to OWASP Top 10, SOC 2, and ISO 27001 controls. Demonstrate continuous security testing with exportable evidence. ## Results Applications tested on the Perfai platform Critical vulnerabilities surfaced and reported In bug bounty value identified before public disclosure ## Next Steps Go from zero to your first security scan in under 5 minutes. Understand how Perfai models apps, workflows, roles, and issues. Sign in and start testing your first app.