Testing capacity is increasingly constrained

Cybersecurity has long relied on penetration testing – having experts run attack scenarios, probe applications and infrastructure, and scan for any weaknesses. It remains one of the most effective ways organizations can find vulnerabilities before attackers do. But with AI supercharging capabilities on both sides of the law, strong cybersecurity defenses are becoming less important to remaining breach-free than the speed with which organizations can identify risk, validate, and remediate it.

The expertise needed to perform pen testing, however, isn’t easily scalable to meet the burgeoning demand. Meaningful manual testing can take weeks, limiting how effectively organizations can defend against attacks as software, apps, and infrastructure change constantly. Manual testing just can’t keep up. Not only does AI enable attack activity on a massive scale, the window between a vulnerability’s discovery and its exploitation is rapidly shrinking.

Security leaders face a simple reality: it’s not enough to conduct a test. Now, organizations must be able to test their environments, frequently, and respond rapidly to any potential threat.

AI is changing what penetration testing can investigate

Used responsibly, with security tools and appropriate oversight, AI has the potential to expand what pen testing can do beyond identifying potential weaknesses. First, it can quickly assess whether the vulnerabilities it detects are exploitable, helping organizations to prioritize remediation of their weakest defenses. It can also map the extent of the weakness by investigating:

  • which systems or components an attacker could likely access by capitalising on it
  • whether relatively minor weaknesses, when combined, could create a material attack path
  • which data, functionality or business assets could be exposed as a result
  • what remediation options are available

The focus has shifted from finding isolated vulnerabilities to mapping and understanding complex paths of attack and the real-world impact they could have – capabilities that experts have but cannot scale. Frontier AI models are already able to reason across complex tasks, work with code, and support multi-step investigations, thus extending scarce human expertise.

Better testing means better prioritization

From an operational perspective, this shift could create a volume problem: automated defenses may find long lists of vulnerabilities, but not every vulnerability constitutes the same level of risk. Far more valuable is the ability to identify which vulnerabilities are 1) actually exploitable and 2) materially important, and prioritize those for testing and remediation.

AI-assisted testing can support security teams effectively prioritize limited remediation capacity by analyzing how vulnerabilities connect to:

  • application components
  • dependencies
  • likely attack paths
  • potential business impact

This offers greater visibility over the entire network, bringing clarity to exposure management, risk assessment, and exploitability, as well as the strategic advantage of faster, better-informed decisions around what to fix first.

The bigger prize is risk reduction

Two-thirds of organizations’ security operations are prioritizing AI adoption, but once cybersecurity has identified vulnerabilities, someone still needs to understand the underlying problem, work out how to fix it, implement that fix, and then validate whether it has worked. This often requires multiple hand-offs between security and development teams.

AI offers numerous capabilities that are already compressing this cycle – more than 60% of organizations report at least a 5% reduction in time-to-detect, while nearly 40% reduced their remediation time by 5% or more. By analyzing both the vulnerable code and its surrounding context, and then suggesting appropriate remediation approaches, AI not only speeds up discovery but also reduces the length of time the vulnerability remains unresolved. It is essential, however, that human security expertise remains firmly in the loop to validate the AI agents’ findings, assess the proposed remediation approach, and independently determine whether the remedy is safe, viable, and appropriate.

AI scales expertise. It does not remove the expert

The “assisted” in “AI-assisted penetration testing” is crucial – autonomous AI cannot replace penetration testers. Its ability to perform repetitive investigative work and explore multiple attack paths can certainly increase the speed, scale, and persistence of organizations’ cybersecurity operations. But it cannot replace the human expertise that provides business context, judgement, validation, and accountability, including the ability to determine how severe and material a threat truly is.

For senior leaders, therefore, questions of governance are paramount: organizations need crystal clear clarity on where AI is permitted to act autonomously, where human approval must be sought, and how AI-generated findings are validated.

From periodic testing to continuous validation

With business cycles a thing of the past in our always-on world, traditional methods of periodic penetration testing are no longer up to the job. Fortunately, AI offers the capability for more frequent testing, keeping up with the constant flux in applications, code, and dependencies to enable a continuous security-validation model that replaces occasional snapshots. This in turn shortens the feedback loop between development, security, and operations, as well as remediation and revalidation.

The effectiveness of an organization’s monitoring and remediation depends on:

  • how much of its environment is tested
  • how often it is tested
  • how quickly it can prioritize and fix issues
  • where to exert human oversight
  • how AI use in offensive security is governed

It’s already possible for organizations to transition to ongoing pen testing at enterprise scale thanks to AI. The next step is ensuring execution keeps pace with modern software development and AI-enabled threats.

Contact our cybersecurity specialists to explore how AI-assisted testing can help strengthen your resilience and reduce cyber risk.