Continuous agentic Offensive Security creates value only when agents understand the application the way a skilled tester does: as a set of real product capabilities.
- Login
- Update a project
- Export a report
- Change a role
- View logs
Those are the actions that carry business risk and the actions that trigger the APIs, state changes, and authorization boundaries security teams care about.
Until recently, discovery in most programs stopped at inventory. Crawlers found pages, specs, and code graphs surfaced candidate endpoints, and probing confirmed what responded. That is necessary work, and Terra still does all of it. But inventory alone leaves a gap: when a signal fires on an API call, it is often hard to answer the practical question AppSec and pentesters ask next: which product feature caused this request, and how do I get back to that UI path to verify it?
Terra Platform™ closes that gap with Feature Analysis, the autonomous process for mapping and interacting with target applications and their internal features. For a given webpage, it surfaces the real product capabilities on that page, the steps to reproduce them, and the related API traffic behind each feature with links out to matching endpoints and webpages. It is available in Terra Platform and the Terra Offensive Research Collaboration Hub (TORCH) under Assets → webpage → Features, and it is now enabled by default for tenants as part of Terra’s broader discovery pipeline.
For CISOs, this is a coverage and assurance story. Testing is grounded in how the product is used, not only in what the network path inventory happened to enumerate. For technical operators, it is a verification and triage accelerator. Features become first-class objects you can inspect, replay, and connect to signals. The rest of this article explains what Feature Analysis is, how it works, what shipped in recent improvements, and what it means for Terra’s agentic testing model.
What Feature Analysis Is
Feature Analysis treats a webpage as a workspace of product capabilities, not a static document. When Terra analyzes a page, agents interact with the UI to identify the actions a user (or an attacker) can actually take. The output is a feature inventory tied to that page: named capabilities such as “view logs” or “update project,” reproduce steps for how Terra reached and exercised the action, and the related API requests generated along the way.
In the platform UI, that inventory shows up in a Features experience designed for investigation. You get a feature list and detail pane, reproduce steps, related endpoints with link / open / replay actions (including copy URL for the underlying request), and an executed-versus-blocked status driven by policy and guardrails. That last point matters: Feature Analysis is not “click everything indiscriminately.” Sensitive operations can be blocked by default and marked clearly, so operators see both what the app exposes and what Terra deliberately did not execute without approval.
This is the same discovery philosophy Terra uses across the agentic pipeline, applied specifically to application features. It complements crawling, code and API discovery, and probing. Feature Analysis is the layer that answers: once we are on this page, what can someone do, and which backend calls does that produce?
For enterprise buyers evaluating agentic platforms, the distinction is strategic. Scanners and shallow crawlers optimize for breadth of paths. Feature Analysis optimizes for fidelity of product behavior. Breadth without feature context produces volume. Feature context turns volume into an attack surface map that AppSec, pentesters, and CISOs can reason about in product language.
How Feature Analysis Works
From activation to page-level feature mapping
Feature Analysis sits inside Terra’s automatic discovery flow. When an application is activated, Terra no longer waits for a separate, easy-to-forget discovery kickoff for the core mapping loop. Navigation profiling learns non-href navigation elements so crawls can replay UI movement more reliably. Crawlers run on pages and domains can be suggested and controlled from scoping settings. Endpoint parameterization consolidates noisy path variants. Probing runs after crawling to find endpoints that crawl alone would miss from code, Swagger, or JavaScript. And Feature Analysis runs on new webpages so each discovered page accumulates a feature map as the inventory grows.
The results feed downstream agent work. Features help operators jump from an API-centric signal to the webpage that initiated the request. They also enrich Terra’s understanding of application behavior for later stages so agents are not inventing product meaning from raw traffic alone. In that sense, Feature Analysis is both a discovery engine and a context layer. It expands what Terra can find, and it explains what Terra found in product terms your team already uses.
Guardrails, sensitive features, and operator ontrol
Enterprise continuous testing has a non-negotiable constraint: discovery must deepen coverage without becoming unauthorized or destructive behavior. Feature Analysis is built with that constraint in mind. Sensitive actions can be blocked by default. The Features UI reflects executed versus blocked status from policy and guardrails, so the inventory remains honest. Terra agents can see a sensitive capability without automatically running it.
That visibility is itself a security outcome. Many programs only learn that a dangerous workflow exists after someone manually clicks through the app or after an agent fails mid-run. Feature Analysis surfaces the capability early, labels the policy decision, and keeps the record attached to the webpage asset so scoping conversations, RoE decisions, and POV planning happen against a concrete feature list instead of tribal knowledge.
Operators are not stuck with an all-or-nothing choice. Terra supports controlled overrides for blocked feature analysis so teams can deliberately unblock and analyze a sensitive feature when the context warrants it. That keeps Human-on-the-Loop discipline intact: autonomy expands coverage; humans retain control over high-impact actions.
Scoping also remains part of the control plane. Wrong app URLs, overly broad domains, or duplicate app onboarding can inflate crawl and Feature Analysis volume, which is why confirmation on activation, license limits, and scoping controls matter as much as the feature itself.
What’s New: Improvements That Make Feature Analysis Usable at Scale
Feature Analysis is now GA for all Terra customers in Terra Platform and TORCH. The new feature UI preview gallery recently shipped a clearer feature list and detail pane, reproduce steps, related-endpoint link/open/replay actions, and visibility into executed versus blocked status. That is the difference between “the system ran some UI automation somewhere” and “I can open this page’s features, see what Terra found, and replay the API behind a specific capability.”
Recent discovery quality improvements around Feature Analysis also raised the floor for hard applications. Subpath hash-router SPAs (for example, routes under /formbank/#/payment) can now be persisted as distinct webpages instead of collapsing into a single path. This is critical because Feature Analysis can only map features on pages that exist as durable assets.
Probing enhancements reduced redundant work, and parametrization improvements cut duplicate inventory so Feature Analysis and downstream signaling operate on cleaner endpoint families. Updates to how non-link UI navigation is learned and replayed also directly affect how completely Feature Analysis can traverse real product workflows.
Feature Analysis Benefits for CISOs and Security Practitioners
For AppSec engineers, pentesters, and TORCH operators, Feature Analysis shortens the loop from hypothesis to verification. When reviewing signals, it is often difficult to know which UI feature initiated an API request. Feature Analysis makes that relationship visible. It means practical triage time saved on every ambiguous signal and higher confidence that coverage includes workflows that never appear as neat, linked HTML. Reproducing steps also help a human tester or reviewer to re-enter the same path without reverse-engineering agent traces from scratch.
For CISOs and security leaders, Feature Analysis is evidence that Terra’s agentic model is oriented around business-relevant behavior. Boards and auditors do not ask how many URLs you crawled. They ask whether critical capabilities are continuously validated. Feature Analysis is how Terra represents those capabilities as durable platform objects, with provenance that supports both investigation and assurance narratives. Combined with Terra’s validation model and Human-on-the-Loop oversight, it strengthens the claim that continuous testing is mapping your product, not merely spraying a generic checklist.
What This Means for Terra
Feature Analysis is a structural step in Terra’s discovery architecture. It marks a shift from attack-surface inventory as a list of assets to attack-surface understanding as a map of product capabilities. Strategically, that matters for three reasons.
- Coverage claims become more defensible. Deeper, more accurate mapping of web apps and their internal features is the precondition for agentic testing that finds exploitable risk in real workflows rather than only in easily enumerated endpoints.
- Operator trust improves. Transparent feature objects make autonomous discovery inspectable, which is how enterprise teams adopt agentic systems without treating them as black boxes.
- Terra Platform compounds. Features feed verification, business context, and future agent tooling; activation-time discovery means every newly accepted application starts building that context immediately.
If you want to see Feature Analysis on your applications, including the Features tab, reproduction steps, related API replay, and how feature maps improve signal investigation, schedule a demo of Terra Platform™.
