AI Penetration Testing: How AI can be used in Penetration Testing Today

Security teams are being asked to add AI to penetration testing at the same time attackers are already using it. The label "AI pentesting" now covers two different jobs: using artificial intelligence (AI) to test ordinary applications and networks, and testing the AI systems themselves.

The pressure to do something with AI is real. The United Kingdom's National Cyber Security Centre (NCSC) has assessed that AI will almost certainly increase the volume and heighten the impact of cyber attacks. Gartner has predicted that AI agents will cut the time needed to exploit account exposures by 50 percent by 2027. In September 2025, Anthropic discovered and disrupted what it described as the first documented large-scale cyberattack executed without substantial human involvement. The campaign used Claude Code against about 30 targets. Anthropic estimated the model performed 80 to 90 percent of the tactical work.

Regulated programs still expect security to be tested, not only documented. The Department of Defense's Cybersecurity Maturity Model Certification (CMMC) exists because the defense industrial base faces increasingly frequent and complex cyber-attacks. Assessments are how the Department checks that the required controls are in place. Phase II third-party assessments were suspended on July 13, 2026. Phase I self-assessments and National Institute of Standards and Technology (NIST) SP 800-171 Revision 2 still apply.

Contents

• How AI Is Used in Penetration Testing Today
• Benefits
• Limitations and Why Human Expertise Remains Central
• AI-Driven Penetration Testing vs. Penetration Testing AI Systems
• AI-Driven Penetration Testing and Prescient Security
• Conclusion

How AI Is Used in Penetration Testing Today

AI-driven penetration testing is penetration testing that uses AI to automate and extend work a human tester already does. The stages are the familiar ones. What changes is who, or what, is doing the repetitive parts.

Reconnaissance and Asset Discovery

An AI agent maps the target: hosts, application programming interface (API) endpoints, input fields, authentication flows, and other attack surfaces. Prescient Security's Cacilian AI Tester (CAIT™), known as Cait, uses a security agent loop that explores and classifies application flows first. It then plans attacks from that map rather than from a static payload list. An agent can also keep walking the application overnight.

Yet that does not provide a complete list of assets. Agents cannot always detect assets protected by unusual authentication measures, such as those on offline networks, or involving undocumented integrations. Someone must define the scope and state what it includes.

Vulnerability Scanning and Exploitation

Once the map exists, agents attempt exploits. Agents use the same tools a human tester would, such as sqlmap, then adapt based on the application's responses. Cait is optimized for common web and API issues. Those include Structured Query Language injection (SQLi), cross-site scripting (XSS), insecure direct object reference (IDOR), server-side request forgery (SSRF), command injection, and broken authentication and authorization.

Validation is the step that separates this from a scanner. Confirmed findings are reproduced in a controlled way. Cait attaches one to three HTTP request and response pairs, Common Vulnerability Scoring System (CVSS) scores, and remediation notes to each high-quality finding.

Safety controls matter here. An example of this would be running simulated attacks with limits such as no lateral movement. Those limits protect production. They also mean the test is not a full simulation of an attacker who will not stop at the application tier.

Testing AI Systems Themselves

Testing an AI system is a different engagement from using AI to test a website. The target is the model and everything wired to it: prompts, retrieved documents, and any tools the model is allowed to call. Traditional pentests often miss these AI-specific attack patterns, which do not look like a broken login form or a missing header.

The work is behavioral. Testers try to make the model ignore its instructions, pull data it should not see, or invoke a tool it should not use. AI can generate a large volume of those probes. Deciding whether a response is actually a leak, or whether a tool call would have been allowed in production, still falls to someone who knows the product.

Report Generation

AI-powered tools prepare the description, the steps for reproducing the issue, an assessment of the impact, and guidance on the fix, and they can automatically attach the HTTP evidence. It is also the point at which false details may be introduced if no one checks the draft against the actual evidence.

In order for a report to be useful, it should name the affected asset, include the request which caused the problem, state who is at risk, and inform the engineering team of the changes needed. The replayable proof should also be included in the report together with any CVSS score.

Benefits

Manual tests remain effective, but they are episodic. AI-assisted testing changes the operating model in four ways:

• Frequency. An AI-assisted run can start after a release, overnight, or on a weekend, and Cait's subscription includes up to two retests within 30 days of the original scan. Rather than waiting for an annual audit cycle, scans can integrate into release pipelines to validate pull requests and staging environments continuously.

• Consistency. A fixed agent loop applies the same methodology to every asset.

• Cost. AI-assisted testing reduces hours spent on recon and low-severity findings. It does not remove the cost of a human review. Some frameworks, including PCI, still expect a human to review findings. A customer questionnaire or a CMMC self-assessment package has the same constraint.

• Evidence quality. For web and API issues, an exploit-validated finding with HTTP request and response pairs is something a developer can reproduce and close. Scanner tickets often cannot.

Limitations and Why Human Expertise Remains Central

Hallucinations

Language models have a tendency to invent. Anthropic pointed out that even during the September 2025 campaign, Claude at times invented credentials or stated that it had extracted secrets which were in fact already public. On the defensive side, the same kind of failure leads to a "finding" that references a header, a path, or an impact that was never actually observed. When the report generator and the exploit agent are based on the same model, the fiction can be internally consistent and yet still be incorrect. The only dependable way to verify this is to reproduce the results from the raw traffic.

False Positives

A scanner detects a particular pattern and the tester or validation agent then has to demonstrate that it is both reachable and harmful within this application. XBOW's own benchmarking showed that its automated system exceeded the performance of the staff on easy and medium tasks but fell behind an expert when it came to hard tasks. That is the actual situation in practice: the routine work is compressed while the difficult cases are not.

Output that has not been validated cannot be regarded as evidence. As stipulated in PCI DSS Requirement 11.4, a documented methodology must be followed by a qualified and organizationally independent tester. A PDF comprising the issues produced by a model, without containing a replay and without having a named reviewer, would fail that requirement. Testing must be performed by a qualified, organizationally independent resource.

Complex Business Logic

IDOR in a sample API is a pattern an agent can learn. "This discount code should never stack with that rebate for this customer class in this state" is not. Cait's own documentation puts complex business-logic and domain-specific edge cases on the human list, along with social engineering, mobile and binary work, and multi-system scenarios. For many organizations they are the reason the test was bought.

The same rule holds true for decisions regarding scope, threat modeling, and the judgment that a particular finding represents acceptable risk. An agent may rank vulnerabilities using the CVSS scale, but it should not independently conclude that a medium-severity finding relating to the payroll file is more urgent than a high-severity finding.

The Accountable Human-in-the-Loop

AI-driven testing does not change who is accountable.

A tester who already has Cait's exploration history won't go over the recon work on day one; instead, that time will be used for chained bugs, privilege boundaries, and the workflows which are specific to this business. Prescient Security states this division clearly in that the AI takes care of the scalable web and API work while the human offensive team is brought in when the risk profile or the audit demands it.

A person remains informed even when the tooling doesn't require it. With respect to the CMMC self-assessment, an Affirming Official must still confirm that the controls are working. The PCI DSS also still demands a qualified tester. Neither of these programs has published a pathway whereby an unsigned AI report can be sufficient by itself. For compliance-driven testing, a named reviewer will still be required by contract.

AI-Driven Penetration Testing vs. Penetration Testing AI Systems

Vendors use "AI pentesting" for both categories. They refer to two completely separate spheres, and require different testing approaches.

An organization can need both. A customer-facing assistant that queries internal documents is an LLM application sitting on ordinary web and API infrastructure. Testing the chat interface for prompt injection does not test the IDOR on the document API. Buying one engagement and assuming it covers the other is the current confusion.

AI-Driven Penetration Testing and Prescient Security

Cait™ was developed by Prescient Security as an AI-assisted tool for testing web applications and APIs, not as a substitute for manual assessment. It continuously investigates, devises attacks based on observed behavior, and presents the results together with HTTP evidence, information on the impact, a CVSS score, and remediation advice suitable for SOC 2, ISO/IEC 27001, and customer questionnaires. Where applicable, findings are subject to exploitation validation.

Cait is designed to act as a middle ground between a vulnerability scanner and a full manual test. Scanners are quick but have limited context, while manual tests are comprehensive, are carried out as projects, and are costly, with the reports becoming outdated when the product is modified. Cait offers ongoing, context-driven testing so that a human tester can begin their work based on the test history rather than having to carry out reconnaissance all over again. Those organizations which still require social engineering, mobile or binary testing, or a compliance-based full-scope assessment continue to use Prescient Security's offensive team.

Conclusion

AI-driven penetration testing is already in use, and attackers have used the same class of agent on offense. The remaining work is to keep the two jobs separate and to keep a qualified person on the result. An organization testing web applications and APIs can use AI-assisted coverage between manual assessments. An organization shipping an LLM application still needs a distinct test of the model, its prompts, and its tools. In both cases, human review and accountability remain critical when the results are being used as compliance or audit evidence.

Learn how your organization can leverage Cait to elevate it's security posture