Who should retain control when organisations adopt autonomous pentesting?

Humans should retain control over test scope, rules of engagement, aggressive test approval, sensitive findings review, and final risk acceptance. Autonomous systems can execute complex probes and adapt quickly, but they should not make production risk decisions. Clear governance keeps testing useful without turning it into an uncontrolled attack simulation.

Why This Matters for Security Teams

autonomous pentesting changes the operating model of security validation. The value is obvious: faster coverage, broader attack path exploration, and repeatable testing at a scale that manual teams rarely sustain. The risk is equally obvious: once an agent can enumerate targets, chain exploits, or pivot based on live feedback, it begins to resemble an adversary with delegated authority. That is why control must remain with humans for scope, approval, escalation, and acceptance decisions. The governance problem is not whether the tool can move quickly, but whether the organisation can prove that it stayed inside authorised boundaries.

Current guidance around agentic systems, including the OWASP Agentic AI Top 10, points to the same core concern: autonomous execution must not become autonomous accountability. Security leaders should treat autonomous pentesting as a high-trust capability that needs explicit guardrails, auditability, and human sign-off at each material decision point. In practice, many security teams only discover that boundary problems exist after a scan hits production instability, a protected system, or an unapproved exploit path.

How It Works in Practice

The safest operating model is shared control. Humans define the mission, and the autonomous system carries out bounded actions inside that mission. That means a security team should set the asset list, exclude sensitive systems, define time windows, and identify stop conditions before execution begins. The agent can then perform recon, test hypotheses, and adapt its probes, but it should not broaden scope on its own or authorise aggressive exploitation without an explicit approval step.

Practical governance usually includes:

• Pre-approved rules of engagement that specify target classes, payload limits, and no-go zones.
• Human approval for intrusive steps such as privilege escalation, data exfiltration simulation, or payload delivery.
• Review of all high-severity findings before they are shared, ticketed, or used to trigger response workflows.
• Logging that records prompts, tool calls, outputs, and operator interventions for later audit.
• Rollback and kill-switch procedures if the agent touches unexpected systems or crosses a risk threshold.

Risk management should align with the NIST AI Risk Management Framework, especially governance, mapping, and measurement activities. For teams testing agent behaviour or tool use, the CSA MAESTRO agentic AI threat modeling framework is useful for identifying where authority, tool access, and escalation paths can be abused. These controls tend to break down when autonomous testing is pointed at hybrid environments with weak asset inventory, shared credentials, or unstable production-like replicas, because the agent cannot reliably distinguish intended targets from adjacent systems.

Common Variations and Edge Cases

Tighter control often reduces testing throughput, requiring organisations to balance speed against assurance and operational safety. That tradeoff becomes sharper when autonomous pentesting is used in regulated sectors, multi-tenant environments, or production-adjacent networks where even benign probes can affect service quality. In these cases, best practice is evolving, but current guidance suggests keeping humans in the approval loop for any action that could change system state, trigger alerts, or expose regulated data.

Edge cases matter. A fully isolated lab may tolerate more automation than a live enterprise network, but there is no universal standard for how much autonomy is acceptable across environments. If the test uses model-driven decisioning, the AI system itself also becomes part of the attack surface, which is where resources like the NIST AI Risk Management Framework and the MITRE ATLAS adversarial AI threat matrix help teams think about manipulation, misuse, and unreliable outputs. Where agentic workflows are involved, the OWASP Top 10 for Agentic Applications 2026 is a useful reference for prompt injection, tool abuse, and over-permissioned actions. The practical lesson is simple: autonomy can accelerate testing, but human ownership must remain intact for anything that affects real risk decisions.

Related resources from NHI Mgmt Group

• Should organisations replace DAST with autonomous pentesting?
• How should organisations control autonomous response in an AI SOC platform?
• Should organisations use autonomous pentesting before strengthening identity controls?
• How should security teams implement autonomous pentesting without losing control of scope?