What teams ask first.

No. The swarm starts from what you ship, the way an attacker does. You can share more access if you want it to go deeper.

Mobile apps, APIs and cloud infrastructure, on external and internal products.

No. Scanners match known patterns. The swarm follows what it finds and reports what it can prove.

Scope, rate limits and test accounts are agreed with you before anything runs, and a run can be stopped at any time.

A report with the severity, evidence, impact and fix for each finding.

It can sit alongside one. A swarm covers more ground, more often. A person brings judgment.

Yes. Run it before a launch, after a big change, and after fixes to confirm they held.