What AI can do in a penetration test today
AI helps most where a task is repetitive, text-heavy or easy to check. In penetration testing that covers a series of tasks across the five stages of a test. The table maps each task to the role AI plays and the check a human still makes.
| Task | What AI does | What a human still checks |
|---|---|---|
| Reconnaissance | Summarises public information, groups assets and suggests likely entry points | Whether each asset is in scope and whether the picture is complete |
| Scanner triage | Removes duplicates, groups related findings and ranks them | Whether a finding is real, using the CVSS context of your environment |
| Script and payload drafting | Writes and adapts scripts, proof-of-concept code and test inputs | Whether the code is safe to run against your systems |
| Fuzzing and input generation | Produces varied test inputs for forms, APIs and file parsers | Which crashes and responses matter |
| Autonomous agents | Chain steps such as scanning, login attempts and exploitation inside a defined scope | Scope limits, rate limits and every impactful action |
| Report drafting | Turns notes and evidence into readable findings and remediation text | Accuracy, risk ratings and business impact |
| Code review support | Flags suspicious patterns in source code during white box tests | Whether a flagged pattern is exploitable |
Models and tools change quickly, so judge any claim by the evidence a provider shows: a sample report, a described method and named reviewers. The NIST SP 800-115 guide and the MITRE ATT&CK knowledge base remain the reference points for what a test should cover, whoever or whatever performs it.
What humans still decide in a penetration test
Judgement and accountability stay with people. A signed authorisation letter names a company and its testers, and the consequences of a test that harms a system fall on them, not on a model. These are the decisions that remain human-led:
- Scope and authorisation. Agreeing what may be tested, when and under which rules of engagement.
- Business-logic flaws. Spotting that a refund, a discount or an approval flow can be abused requires understanding how the business works.
- Chained exploits. Combining several small weaknesses into a path to sensitive data needs creativity and patience.
- Social engineering. Choosing pretexts and judging how staff will react depends on context and ethics.
- Safety limits. Deciding when to stop, slow down or ask before an action that could disrupt production.
- Sign-off. Rating risk, explaining it to executives and standing behind the report.
Human-led testing also covers the unusual: a custom protocol, a legacy system or an application that behaves differently from the pattern a model has seen. Experienced testers move between tools and manual analysis as the target requires, and AI becomes one more tool in that set.
A workflow that combines AI and human testers
A hybrid engagement keeps people in charge of decisions and uses AI where it saves time. A well-run project follows this order:
- Scoping and authorisation (human) The provider and buyer agree scope, limits and the authorisation letter, and they decide what an AI tool may touch.
- Reconnaissance (AI-assisted) Tools collect and summarise public information and map assets, and a tester checks the map against the scope.
- Triage (AI-assisted) Scanner output is deduplicated and ranked, and a tester discards false positives.
- Exploitation (human-led) Testers validate and chain weaknesses, using AI to draft scripts that they review before running.
- Reporting (AI-drafted, human-edited) A model drafts finding text, and the lead tester checks facts, ratings and impact.
- Retest (mixed) Automated checks confirm routine fixes, and a tester verifies the complex ones.
The value of the hybrid depends on the review in steps 3 to 5. Ask the provider to show where a named person signs off.
Categories of AI-assisted penetration testing
Offers in the market fall into a few categories. The names vary by provider, so ask what the system does in each stage rather than relying on the label.
| Category | What it is | What to ask |
|---|---|---|
| Autonomous PTaaS platforms | Software agents that run scoped tests on demand or continuously and produce findings | What actions can the agent take, who validates findings and how is scope enforced? |
| LLM copilots for human testers | Assistants used by qualified testers to draft scripts, summarise output and write reports | Which tasks are assisted, and does a named tester review every finding? |
| AI-assisted scanners | Scanners that use machine learning to prioritise, deduplicate or explain findings | Does the vendor prove exploitation, or only list possible issues? |
| Hybrid services | A provider that combines automated agents for routine coverage with human-led testing for depth | Which parts are automated, and what do the humans test that the agents do not? |
The categories are not a ranking, and a hybrid is not automatically better than a human-led test. What matters is the evidence for each finding and whether the provider's method fits your risk. See the guide to choosing a penetration testing company for the full checklist.
How to evaluate an AI penetration test offer
Treat an AI-driven offer like any other penetration testing proposal, and add questions about the AI itself.
- What exactly does the AI do? Ask for the tasks it performs in each stage, not a brand name.
- Who reviews the findings? Ask for the role and credentials of the reviewer, and whether every finding is validated.
- Is exploitation proven? Ask for proof of concept for each finding, not only a severity score.
- Where does data go? Ask which model processes your data, where it runs and whether it is retained or used for training.
- How is scope enforced? Ask about allowed actions, rate limits, a kill switch and logging of every action.
- Can results be reproduced? Ask whether another run on the same target produces the same findings.
- What does the report contain? Ask for a sample with CVSS ratings, evidence, remediation steps and an executive summary.
- Will your assessor accept it? Ask the party that reads the evidence, such as a PCI DSS assessor or certification body, before you buy.
Request a sample report and the methodology document before you sign. If the provider cannot show who is accountable for a finding, the finding has no owner.
Contract terms for AI-assisted penetration testing
Add AI-specific terms to the standard contract checklist. They protect your data and make accountability clear.
- Model disclosure. The provider names the models and vendors that process your data, and tells you if they change.
- No training on your data. Prompts, logs and findings are not used to train models.
- Data location and retention. The contract states where data is processed, how long it is kept and when it is deleted.
- Named reviewer. A qualified person reviews and signs off every finding in the report.
- Action limits. The authorisation letter lists what an autonomous agent may do, with rate limits and a kill switch.
- Incident notice. The provider tells you promptly if testing data is exposed or an agent acts outside scope.
Risks of AI-driven penetration testing
- False positives and invented findings. Models can report weaknesses that do not exist or describe real ones inaccurately, so each finding needs validation.
- Data leaving your environment. Prompts, logs and evidence may pass to a third-party model provider. Agree where data is processed and how long it is kept.
- Third-party model exposure. The model vendor becomes a data processor. Check its terms and your obligations under the UAE Personal Data Protection Law.
- Scope and safety. An autonomous agent can act faster than a person can intervene. Limit actions, set rate limits and keep a human on watch.
- Hostile content. An agent that reads web pages or documents can be steered by instructions hidden in them.
- Over-reliance. A clean AI report does not mean a clean system, because the agent can only test what it can reach and understand.
Will AI replace penetration testers?
For buyers, the useful question is what quality of service to expect. Two facts frame it. Attackers are adopting AI: IBM found that 26% of malicious breaches in its 2026 research were AI-enabled. Credential bodies still assess human skill: OffSec's OSCP+ exam rules state that using LLMs and AI chatbots is strictly prohibited during the exam.
- Share of malicious breaches that were AI-enabled in IBM's 2026 research
- 26%
The practical effect is a higher baseline. Routine checks become faster and cheaper, and the work that needs judgement becomes the reason to hire a provider. Expect quotes to separate automated coverage from human-led testing, and do not pay for scanner output at the rate for manual exploitation. Providers that publish their methods, name their credentials and show sample reports are easier to assess.
How attackers' use of AI changes what you test
If attackers use AI, defenders should test against AI-assisted attacks. AI lowers the cost of tasks that used to need time and skill, so some assumptions in older test plans no longer hold:
- Phishing quality. Well-written, localised messages at scale make phishing simulations with realistic lures more relevant.
- Reconnaissance speed. Exposed assets, leaked credentials and old subdomains are found faster, so external attack surface checks matter more.
- Detection. Faster attacks leave less time to respond, so red team and purple team exercises that measure detection time gain value.
- Your own AI features. Chatbots and copilots add new entry points that need testing.
A provider that plans tests with these changes in mind, and says how, is easier to rely on than one that repeats last year's scope.
Testing AI systems themselves
Organisations that deploy chatbots, copilots and agents also need to test them. LLM red teaming probes a model-based application for the weaknesses that attackers exploit, such as manipulated prompts or excessive permissions. The OWASP Top 10 for LLM Applications lists the main risk categories in its 2025 edition. A test of an AI application checks each category against the way the application is built.
| Risk | What a test checks |
|---|---|
| Prompt injection | Whether crafted input changes the model's instructions or behaviour |
| Sensitive information disclosure | Whether the model reveals personal, confidential or internal data |
| Supply chain | Whether models, plugins and data sources come from trusted, controlled origins |
| Data and model poisoning | Whether training or retrieval data can be tampered with |
| Improper output handling | Whether model output is passed to other systems without validation |
| Excessive agency | Whether the model can take actions or use tools beyond what it needs |
| System prompt leakage | Whether hidden instructions or secrets can be extracted |
| Vector and embedding weaknesses | Whether retrieval stores expose or mix data between users |
| Misinformation | Whether the system presents false output as fact in ways that cause harm |
| Unbounded consumption | Whether requests can exhaust resources or run up costs |
Ask a provider which of these categories it tests, and who on the team has experience with LLM applications. Standard web and API testing still applies to the surrounding application.
Frequently asked questions about AI penetration testing
Is pentesting being replaced by AI?
Not as of November 2026. AI tools speed up reconnaissance, scanner triage and report drafting, and autonomous testing platforms exist, but scoping, authorisation, business-logic testing, chained exploitation and judgement about safe limits stay with human testers. Treat AI-driven offers as cover for routine checks, and ask what a qualified person reviews. Credentials such as OSCP still assess human skill, and OffSec bans AI chatbots in its exams.
Can AI do pen testing?
AI can perform parts of a penetration test: summarising reconnaissance, triaging scanner results, drafting scripts and reports, and, in some platforms, running scripted attack steps inside a scope. It does not carry accountability, and it can invent findings. A full penetration test also needs scoping, authorisation, judgement and proof of exploitation. Ask any provider which tasks are automated and who validates the findings.
Which AI is best for penetration testing?
No AI tool is best for every test, and this site does not rank them. The right choice depends on the task, the data you can share and the review process around it. Ask providers which tasks use AI, where the model runs, what happens to your data and who reviews the output. A named, accountable tester with a sample report is a stronger signal than a model name.
Do AI pentest tools produce false positives?
Yes, they can. AI tools may report weaknesses that do not exist, describe real issues inaccurately or rank severity wrongly, as scanners do. Reduce the risk by asking for proof of concept for each finding, a named reviewer who validates results and a retest after fixes. Compare the report with the OWASP Web Security Testing Guide to see whether the test covered what it should.
Is it safe to give an AI tool access to client data?
It is safe only when you control where the data goes. Ask which model processes your data, where it runs, whether prompts and logs are stored or used for training, and who the sub-processors are. Agree an NDA and data retention terms, and check obligations under the UAE Personal Data Protection Law. Limit the agent's access to the scope in the authorisation letter and log every action.
Can AI systems themselves be penetration tested?
Yes. Chatbots, copilots and agents can be tested through LLM red teaming and standard application testing. The OWASP Top 10 for LLM Applications 2025 lists the main risks: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. Ask providers which categories they cover and who has LLM experience.
Is ChatGPT allowed on OSCP?
No. OffSec's OSCP+ exam guide states that using LLMs and AI chatbots, including ChatGPT, is strictly prohibited, and it treats such use as receiving third-party help. The rule covers the proctored exam, and OffSec can update it, so read the current exam guide before you sit the exam. This answer reflects the guide as read in November 2026.
Sources and updates
Statistics and rules on this page come from the sources below, read in November 2026. AI tooling changes quickly, and the page is reviewed every quarter.
- IBM Cost of a Data Breach Report 2026: Middle East findings
- OWASP Top 10 for LLM Applications
- OffSec OSCP+ exam guide
- MITRE ATT&CK
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
Related guides: types of penetration testing and the 5 stages and how to choose a penetration testing company in the UAE.
Last updated