TL;DR: AI tooling is accelerating parts of penetration testing, but Sprocket Security’s account shows the highest-value findings still come from human context, such as timing a retest to a broadcast schedule or spotting a freshly modified VM disk that led to source-code compromise. The operational lesson is that automation scales discovery, while human judgment still drives material impact.
At a glance
What this is: This is Sprocket Security’s analysis of AI-assisted penetration testing, arguing that automation speeds discovery but human context still converts findings into real impact.
Why it matters: It matters because IAM, PAM, NHI, and broader security teams cannot assume automation will surface the business-relevant path; human judgement still identifies when a banner, schedule, timestamp, or credential trail becomes a live compromise path.
Context
AI-assisted pentesting is best understood as a workflow problem, not a replacement problem. Automation can scan, fingerprint, and parse evidence at scale, but it still lacks the operational context needed to decide when a finding is real, when a host is alive, or when a stored artefact becomes valuable. That gap matters wherever testing touches identity, privileged access, or machine credentials, because the highest-value paths often depend on timing, environment state, and the meaning of apparently small signals.
This article shows that the human layer is not a fallback for weak automation. It is the part of the testing model that interprets business context, safety boundaries, and asset behaviour, then turns that interpretation into the next correct action. For security programmes, that means the governance question is not whether AI can assist testing, but where human review remains mandatory because context determines impact.
Key questions
Q: How should security teams handle AI-assisted testing when business context determines impact?
A: Use AI to accelerate enumeration and analysis, but require a human to decide when a finding is operationally meaningful. The practical control is not more automation, but a workflow that ties retesting, validation, and escalation to asset function, timing, and safety boundaries.
Q: Why does deterministic tooling matter on sensitive administrative or operational networks?
A: Because those environments often cannot tolerate unpredictable test behaviour. Deterministic tooling lets infrastructure teams review what will happen before it runs, predict the blast radius, and stop the activity if production state or safety conditions change.
Q: What breaks when VM storage is exposed through readable virtual disks?
A: Offline disk access turns storage into credential exposure. Once an attacker or tester can read guest filesystems, they may recover hashes, SSH keys, cloud tokens, and directory service material that can be reused to reach other systems.
Q: How should security teams balance AI pentesting with human review?
A: Use AI to expand coverage, repeat workflows, and validate exploitability across a broad API estate, then reserve human specialists for novel architecture, highly bespoke logic, and advanced threat modeling. The best programme assigns each type of work to the place where it is strongest.
Technical breakdown
Why context still changes pentest outcomes
AI can accelerate reconnaissance, clustering, documentation parsing, and repetitive validation, but it does not understand whether an observed service is dormant, scheduled, or business critical. In penetration testing, that distinction matters because the same banner can represent a dead end at one moment and a live control path at another. Human context supplies the missing semantics: what the device does, when it is expected to be online, and what a documented command would mean if executed against the target environment. Without that layer, the test may be fast but shallow.
Practical implication: Treat AI output as a lead generator, not the final decision-maker, whenever operational timing or business function determines whether a finding matters.
Why deterministic tooling matters on sensitive networks
Sensitive administrative and operational technology environments often require deterministic, auditable testing because unpredictable behaviour can create safety or availability risk. In those settings, the issue is not whether AI can write code, but whether every action can be reviewed, reproduced, and halted in advance. A human-reviewed script gives the infrastructure team a known blast radius and preserves control over exactly what paths are mounted, read, and logged. That is a governance constraint as much as a technical one, and it is often the reason autonomous execution is unacceptable even when the work is offensive security.
Practical implication: Use deterministic, human-audited tooling when the environment carries production state or safety-critical systems.
How offline disk access becomes credential exposure
Read-only access to mounted virtual disks turns storage exposure into a credential problem. Guest filesystems frequently contain password hashes, SSH private keys, cloud tokens, configuration files, and directory service artefacts that were never meant to leave the runtime boundary. In this case, the path moved from datastore access to offline extraction and then to authenticated source-code access, showing how machine-readable secrets inside virtual infrastructure can become a full compromise chain. That is an identity governance issue as much as a storage issue, because the value of the disk is really the value of the identities it exposes.
Practical implication: Harden virtual machine storage and secrets handling as identity control points, not just infrastructure assets.
Threat narrative
Attacker objective: The objective is to turn contextual exposure into authenticated access that reaches production systems, source code, and credential stores.
- Entry began with exposure of an indexed, unauthenticated service on a broadcast device and later with network-adjacent access to NFS-backed virtualization storage.
- Credential and secret harvesting followed through offline reads of VM disks, Linux shadow files, SSH keys, Windows hives, and domain controller artefacts.
- Escalation occurred when recovered credentials and a fresh developer key allowed access to source control and the broader credential estate.
- Impact was the compromise of live broadcast functionality, internal administrative data, and the company source monorepo with validated credentials.
Breaches seen in the wild
- tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Human context is now the control that converts AI-assisted testing into material security outcomes. Automation can surface a large number of leads, but it cannot decide which lead matches the target’s business rhythm or operational safety boundary. The important finding is not that AI is weak, but that context remains the differentiator between noise and consequence. For practitioners, that means human judgement is still part of the testing control plane.
Deterministic execution is the right pattern whenever a test touches live administrative or operational systems. The article shows that repeatable tooling is not a compromise on quality; it is the condition that makes aggressive testing acceptable inside sensitive environments. That maps directly to identity governance, because privileged access to production-like assets demands auditable action even during offensive work. Practitioners should treat auditable execution as a non-negotiable safety requirement, not an optimisation.
Context-anchored retesting is a distinct security capability, not a convenience. The broadcast example shows that a host’s value can depend on when it is expected to be active, not just whether it responds once. That creates a practical gap between discovery and validation, especially where service identity is tied to operating schedules or human workflows. For teams running validation programmes, the conclusion is simple: asset state and business timing must inform test design.
Machine identity exposure remains the hidden payload inside many infrastructure findings. A mounted disk, a developer home directory, or a mis-scoped share is often interesting because of the secrets it carries, not because of the storage object itself. That is why NHI governance belongs in offensive testing conversations. If the identities stored on or reachable through the system are not inventoried, rotated, and offboarded, the technical finding will outlive the incident response window.
Continuous testing better matches how modern compromise paths emerge. Time-boxed engagements compress away the moments where context reveals impact, while continuous models create room for retesting, validation, and deeper chain building. That does not mean every team needs more automation; it means they need more cycles where human judgement can act on fresh evidence. Practitioners should align testing cadence with the pace at which identities, keys, and exposed services actually change.
What this signals
Context remains the decisive layer in offensive security. AI can compress the time needed to find and organise evidence, but it cannot infer which signals matter to the business or when an asset has crossed from dormant to exploitable. The programme implication is that teams should design pentest workflows around decision points, not just scan volume.
Human review is still the safeguard that prevents context loss. In practice, that means validating schedules, asset roles, and recent changes before turning a discovery into a confirmed finding. For programmes that touch privileged systems or machine identities, this is the difference between noisy automation and a credible security conclusion.
For practitioners
- Build human-in-the-loop retest criteria Define when a previously quiet host, service, or banner should be retested based on business timing, operating schedule, or asset role instead of only scan results.
- Require deterministic, auditable test tooling For sensitive networks, limit offensive scripts to predictable actions that can be reviewed line by line before execution and traced after execution.
- Treat VM disks as secret-bearing assets Assume mounted virtual disks may contain SSH keys, cloud credentials, hashes, and directory service artefacts that can be read offline and reused.
- Tie validation to asset behaviour, not scan state Use operational context such as service hours, host function, and recent modification timestamps to decide which findings deserve deeper testing.
- Review developer endpoints for stale private keys Check live developer machines for recently generated keys, local repository access, and credential material that could bridge into source control.
Key takeaways
- AI-assisted pentesting changes the speed of discovery, but not the need for human judgement where operational context determines whether a finding matters.
- The article shows that timing, asset state, and recent changes can turn an ordinary lead into a high-impact compromise path.
- For security teams, the practical lesson is to pair automation with deterministic, auditable human review whenever testing reaches sensitive systems or identity-bearing assets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article shows keys, hashes, and tokens being recovered from guest systems and reused. |
| NHI-07 — Long-Lived Secrets | Stale SSH keys and unrotated credentials enabled the source-control pivot described here. | |
| Recommendation — Scan guest systems and mounted images for secret leakage before offline credentials become reusable access. Audit long-lived secrets on developer and infrastructure hosts and rotate anything that outlives its business need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack path moved from secret harvesting into authenticated access and broader compromise. |
| Recommendation — Map recovered secrets to Credential Access and Lateral Movement so you can hunt for reuse paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article highlights how access scope and asset context determine whether a test reveals real exposure. |
| Recommendation — Review permissions and entitlements around guest storage and developer access against PR.AA-05. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Recovered keys and hashes are authenticator material that should not remain usable on exposed systems. |
| Recommendation — Apply IA-5 to rotate, revoke, and control authenticators recovered from test targets and disk images. | ||
Key terms
- Deterministic Verification: A verification method that produces the same enforced result every time when the required proof is present, instead of relying on human judgement or probabilistic signals. It is useful for high-blast-radius access changes because it removes discretion from the decision point.
- Operational Context: Operational context is the surrounding information that gives a security finding its real meaning, including data sensitivity, network exposure, identity reach, and business criticality. A vulnerability without context is only a defect report; with context, it becomes a risk decision that can drive containment or remediation priority.
- Offline Secret Extraction: The recovery of credentials, hashes, keys, or tokens from stored files rather than live systems. It is especially dangerous when virtual machine disks, backups, or file shares contain identity material that can be reused for authentication or lateral movement.
- Human-in-the-loop Security: Human-in-the-loop security is a control model where people review, approve, or override important system actions before they take effect. It adds human judgment to automated workflows for access, data use, model outputs, and incident response, especially when AI, NHI, or privileged systems make decisions that could create security, compliance, or safety risk.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control decisions to the wider security programme they run.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org