Hi,
There are a few ways to think about this: ArcGIS Enterprise and ArcGIS Online.
For ArcGIS Enterprise, please review the automated scanning guidance here:
https://trust.arcgis.com/en/customer-documents/ArcGIS%20Enterprise%20Vulnerability%20Scanning%20Guid...
Esri does not recommend specific tools for pentesting. That's up to your discretion and the scope of testing defined by the customer.
For ArcGIS Online, pentesting and automated scanners are prohibited for ArcGIS Online (ArcGIS.com) without Esri’s explicit consent under our terms of use. Use of automated tools may result in investigative action or your IP(s) being blocked. ArcGIS.com users who wish to perform this level of testing should first reach out to their account teams to obtain a Security Assessment Agreement (SAA).
