All ten.Times four.

Full coverage on 9 of 10 categories. A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components (CISA KEV ingest), A07 Authentication Failures (all major IDPs), A08 Data Integrity Failures, A10 SSRF are full. A09 Logging and Monitoring is partial (surfaced as side-effect, not a primary domain).

Full coverage on 9 of 10 categories. BOLA (API1), Broken Authentication (API2), Object Property-Level Auth (API3), Resource Consumption (API4), BFLA (API5), Sensitive Business Flow Abuse (API6), SSRF (API7), Security Misconfiguration (API8), Unsafe API Consumption (API10) are full. Improper Inventory (API9) is partial: shadow and deprecated endpoints are tested but not exhaustively enumerated.

Full coverage on 9 of 10 categories. LLM01 Prompt Injection (direct, indirect, tool-mediated, browser-mediated), LLM02 Sensitive Info Disclosure, LLM03 Supply Chain (slopsquatting, model artifacts), LLM04 Data and Model Poisoning (vector-store, RAG-ingest), LLM05 Improper Output Handling (CVE-2025-32711 EchoLeak class), LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weakness, LLM10 Unbounded Consumption are full. LLM09 Misinformation is explicitly out of scope: content quality, not security.

Full coverage on 9 of 10 categories. ASI01 Agent Goal Hijack, ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain (includes CVE-2025-6514 mcp-remote OAuth RCE), ASI05 Unexpected Code Execution, ASI06 Memory and Context Poisoning, ASI07 Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation are full. ASI10 Rogue Agents is partial: drift detection and scope-bound enforcement are tested but the full rogue-agent taxonomy is still being mapped.

Yes. SSRF (A10 in OWASP Top 10 Web, API7 in OWASP API Top 10) is fully covered. Specialists probe internal-IP endpoints, cloud metadata endpoints (AWS, GCP, Azure), and any URL parameter that could be redirected to internal infrastructure.

Yes. Prompt injection (OWASP LLM01) is one of Swarm's core LLM specialisms. Direct injection (user message), indirect injection (retrieved content), tool-mediated injection (tool output treated as instruction), and browser-mediated injection (page content the agent navigates to) are all tested by dedicated specialists.

Partial means the attack class is tested as a side-effect of the engagement or with limited depth, but it is not a primary specialist domain. For example, A09 Logging and Monitoring gaps are surfaced when a specialist observes missing access logging during another test, but Swarm does not run a dedicated logging-audit phase. Partial findings still appear in the report with remediation guidance.