TL;DR: AI changes pentesting by executing discovery, recon, testing, exploitation, and reporting at machine speed, while the real constraint becomes cost per asset and whether model-driven work is actually needed, according to CYCOGNITO. The practical implication is that automation should cover mechanical phases, while human reasoning stays reserved for creative exploitation and validation.
At a glance
What this is: CyCognito's analysis says AI changes pentesting economics and execution, but the core five-phase attack workflow stays the same.
Why it matters: For IAM and NHI practitioners, the key issue is not whether AI can test, but where automation should stop and human judgment must still govern exploit validation, scoping, and remediation.
Context
Pentesting is a governance problem as much as a technical one: organisations rarely have unlimited budget, unlimited tester time, or complete visibility into what is exposed. When the attack surface changes daily but testing cycles still run quarterly or annually, coverage becomes the real control gap.
The article's identity angle appears where modern environments contain exposed APIs, production signing keys, and AI-connected systems such as MCP servers. Those assets are not only security findings, they are access and trust problems, because a weak control around discovery, authentication, or delegation can create a machine-to-machine entry path that traditional scoping misses.
CyCognito's central point is that AI does not redefine pentesting as a discipline. It changes the economics of which phases can be automated cheaply and which still require human reasoning, which is a familiar pattern in identity security as well: scale the mechanical work, reserve judgment for the high-consequence step.
Key questions
Q: What breaks when AI pentesting is applied to every phase equally?
A: Coverage often gets worse, not better, because token costs make model-driven testing expensive at scale. Repetitive discovery and recon are cheap for scanners and scripted workflows, while the model adds value mainly where reasoning, adaptation, and proof are needed. The practical failure is spending expensive intelligence on work that was already mechanised.
Q: Why do AI pentesting tools become expensive after the first build?
A: Costs rise because the real work starts after the prototype. Model deprecation, prompt retuning, regression testing, token consumption, and dedicated headcount all recur as the environment changes. Internal teams often underestimate these lifecycle tasks, so the tool becomes a product that needs ongoing operations rather than a one-time project.
Q: What are the signs that AI pentesting is being used in the wrong phase?
A: The clearest signs are high token spend on routine checks, repeated command loops for simple enumeration, and a small set of heavily tested assets while the rest of the environment remains untouched. Those symptoms show the programme is paying reasoning costs where deterministic tooling would have delivered the same result more efficiently.
Q: Should teams use AI for exploitation or only for discovery and reporting?
A: Use AI where the task requires adaptation, not where the task is already deterministic. Discovery, recon, and basic checks should usually stay automated, while exploitation can benefit from model-assisted hypothesis testing and reporting once proof exists. The deciding factor is whether the phase needs judgment or just throughput.
Technical breakdown
Why AI pentesting is a workflow, not a new discipline
Pentesting still moves through discovery, recon, security testing, exploitation, and reporting. AI agents do not invent a new process, they substitute for humans or scanners inside an old one. That distinction matters because most of the early phases are repeatable and structured, which means they can be orchestrated deterministically without model reasoning. The real architectural change is executor selection: a model can run commands, interpret outputs, and choose the next step, while the underlying control flow remains the same. In practice, this means buyers should separate orchestration from analysis instead of treating every AI-assisted action as a fundamentally new capability.
Practical implication: Treat AI pentesting as a control-efficiency decision, not a new security category.
Where token cost changes coverage economics
Traditional scanners have a relatively flat cost curve, whether they run against ten assets or ten thousand. Model-driven execution does not. Every command, output summary, and decision consumes tokens, so putting an LLM in the loop for repetitive recon or baseline testing can turn a cheap workflow into an expensive one. That shifts the bottleneck from technical feasibility to economics. Once the cost per asset rises, organisations stop testing the long tail and fall back to familiar targets, which recreates the same coverage gap they were trying to close. The economics therefore become part of the security control model, not just the procurement model.
Practical implication: Use deterministic tooling for repetitive phases before paying model costs for broad coverage.
Why exploitation still depends on human reasoning
Exploitation is different because it requires hypothesis, adaptation, and proof. A scanner can flag a leaked signing key or a suspicious endpoint, but it cannot always infer how that weakness chains into authorisation bypass, tenant access, or data exposure. Human testers still add value when the path is novel, when the target behaves unexpectedly, or when the evidence must be validated against live systems without causing damage. AI can assist here, but it does not remove the need for judgment about scope, safety, and what constitutes trustworthy proof. This is the phase where machine speed helps, but creativity still determines whether a finding becomes a real compromise.
Practical implication: Reserve model-driven effort for complex validation and proof, not routine enumeration.
Threat narrative
Attacker objective: The attacker wants proof of exploitable access that turns an exposed weakness into authenticated control or data access.
- Entry begins with discovery of exposed assets such as forgotten APIs, staging environments, or connected AI interfaces that were never fully mapped.
- Credential or trust abuse can follow when a leaked signing key, weak authentication path, or exposed control plane token allows the attacker to impersonate trusted access.
- Escalation occurs when the attacker uses that access to bypass authorisation, pivot across tenants, or reach data and systems beyond the original entry point.
- Impact is unauthorised access, data exposure, or control of the target application without a reliable human-reviewed validation step.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Coverage is now the primary pentest control gap: AI does not change the attack workflow, but it can change how much of the environment ever gets tested. When cost per asset rises with model usage, the programme quietly stops reaching the long tail, which is where unmanaged exposure often lives. The practitioner conclusion is that coverage economics must be treated as a governance metric, not an operational afterthought.
Model orchestration is only useful where the work is genuinely dynamic: Discovery, enumeration, and baseline checks are mechanically repeatable, so forcing an LLM into those phases adds cost without adding control value. The useful dividing line is between deterministic execution and adaptive reasoning. The practitioner conclusion is to reserve AI for phases that require interpretation, not phases that merely require scale.
Exploit validation latency: the gap between finding a weakness and proving it is real now determines testing value. If a programme can enumerate widely but cannot validate chains that end in actual access, the report may look complete while the risk remains ambiguous. The practitioner conclusion is to measure time to proof, not just time to first finding.
Identity and machine trust are exposed whenever pentesting reaches signing keys, tokens, or AI-connected interfaces: those are not just technical artifacts, they are authentication and delegation anchors. A leaked production signing key or an unauthenticated control surface changes the trust boundary immediately. The practitioner conclusion is to map AI-assisted pentests to the identity layer wherever credentials or delegated access appear.
Continuous testing only matters if the scope keeps pace with the attack surface: the article's most important signal is that annual or twice-yearly pentests cannot keep up with daily change. That is not an argument for more reports, it is an argument for better scoping and more selective use of human reasoning. The practitioner conclusion is to align testing cadence with asset churn and business exposure.
What this signals
Coverage economics will shape pentest maturity more than model capability will: the organisations that get the most value from AI-assisted testing will be the ones that keep repetitive work deterministic and spend model capacity only where it changes outcomes. The programme question is not whether AI can touch every phase, but whether it should.
Identity trust anchors deserve priority in any AI-assisted test plan: signing keys, authentication tokens, unauthenticated control surfaces, and delegated machine access are the shortest path from exposure to impact. Where those assets exist, continuous discovery matters more than a one-off annual test, because the trust boundary can move faster than the review cycle.
Exploit proof is becoming the dividing line between noise and risk: a finding only becomes actionable when the tester can reproduce the chain and show the access consequence. That pushes security teams to invest in validation discipline, not just broader scanning, because volume without proof does not reduce uncertainty.
For practitioners
- Define a deterministic-first pentest workflow Use scanners and scripted checks for discovery, enumeration, and baseline vulnerability testing before assigning any model-driven orchestration to the same tasks.
- Reserve model reasoning for exploit validation Apply AI only where the tester must adapt to unexpected responses, chain findings, or prove reachability on a live target without causing disruption.
- Measure cost per asset before expanding coverage Track token spend, command count, and output volume per target so the programme does not collapse back to a small set of familiar assets.
- Scope around exposed trust anchors Prioritise assets that expose signing keys, tokens, unauthenticated interfaces, or delegated control paths, because those create the fastest route from finding to access.
- Separate proof from reporting Require exact requests, responses, and reproducible steps before any AI-generated summary is accepted as a valid pentest finding.
Key takeaways
- AI pentesting does not replace the pentest workflow, but it changes the economics of who performs each phase and at what cost.
- Discovery, recon, and baseline testing are the most automatable phases, while exploitation still depends on adaptation, judgment, and proof.
- Security teams should scale deterministic tooling first, then use model-driven testing only where reasoning adds measurable value.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0007;TA0006;TA0008;TA0004 — Discovery; Credential Access; Lateral Movement; Privilege Escalation | The article describes adversary-like workflow stages from discovery through exploitation and access expansion. |
| Recommendation — Map AI-assisted testing outputs to ATT&CK tactics and prioritise controls around discovery, credential access, and privilege escalation. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and recorded | The article centres on finding unknown and exposed assets before testing begins. |
| Recommendation — Use ID.RA-01 to ensure discovery processes keep the exposed asset inventory current enough for testing decisions. | ||
| NIST SP 800-53 Rev 5 | CA-8 — Penetration Testing | The article is fundamentally about how penetration testing is executed and scoped. |
| SA-11 — Developer Testing and Evaluation | The piece emphasises proof, reproducibility, and verification before remediation. | |
| Recommendation — Apply CA-8 to define when automated testing is sufficient and when human-led validation is required. Use SA-11 to require reproducible evidence before accepting an AI-generated finding as actionable. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The article's examples include exposed signing keys and unauthenticated interfaces that create access paths. |
| Recommendation — Review exposed APIs and authentication paths for weak or missing authentication before scaling AI-driven testing. | ||
Key terms
- Pentesting Orchestration: The coordination layer that turns model outputs into a structured penetration testing workflow. It sequences tasks, passes context between steps, and controls when the system should continue, stop, or hand work to a human reviewer.
- Deterministic Workflow: A deterministic workflow is a fixed sequence of investigation steps that produces the same output when given the same inputs. In SOC automation, it reduces variability, improves auditability, and creates a stable evidence trail before any AI reasoning is applied.
- Exploit Validation: The process of proving that a suspected vulnerability is actually exploitable by producing a working proof of concept. This is a high-value security task because it separates real exposure from noise and can be automated with sufficient model and workflow support.
- Coverage economics: The relationship between the cost of security inspection and how much of an environment can be inspected often enough to matter. In code security, it describes the trade-off between broad continuous scanning and slower, more expensive reasoning or manual validation.
Deepen your knowledge
NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme they already run.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org