AI pentesting is becoming a continuous control, not an annual exercise

At a glance

What this is: This is Synack’s case study on how Iberia Cards is using AI pentesting to add recurring offensive testing between deeper researcher-led engagements, with a key finding that recurrence and business-logic coverage matter as much as depth.

Why it matters: It matters because IAM, PAM, and broader security teams increasingly need continuous validation of exposed services, authenticated workflows, and AI-enabled attack paths rather than relying on annual tests that miss fast-changing risk.

By the numbers:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.

👉 Read Synack’s case study on Iberia Cards and AI pentesting for regulated environments

Context

AI pentesting sits in the gap between annual offensive security assessments and the pace of modern attack development. In regulated environments, the problem is not only whether a control exists, but whether it can be exercised often enough to catch business-logic flaws, authenticated abuse paths, and exposed assets before attackers do.

For identity teams, the relevance is direct. When AI lowers the cost of targeted reconnaissance and exploitation, credentials, session boundaries, and access scope become more valuable attack surfaces, especially where human approval cycles are too slow for machine-speed risk.

Iberia Cards’ starting position is typical of mature regulated organisations: strong compliance pressure, a need for traceability, and a recognition that annual testing alone is not enough to measure real exposure.

Key questions

Q: What breaks when penetration testing is only done annually?

A: Annual testing breaks down when environments change faster than the assessment cycle. New code, cloud resources, identities, APIs, and integrations can appear after the test and remain untested for months. The result is stale evidence that supports decisions about an environment that no longer exists, which is especially dangerous in cloud and identity-heavy programmes.

Q: Why do AI-enabled attackers change the value of offensive security testing?

A: AI lowers the cost of reconnaissance and tailored probing, which means attackers can focus on business-specific weaknesses faster and more often. That increases the importance of recurring offensive testing, because the defender is no longer protecting against a rare, expensive attacker but a cheaper, faster one that can iterate repeatedly.

Q: How do security teams know whether offensive testing is actually reducing exposure?

A: Look for closed-loop outcomes, not raw finding counts. The right signals are validated exploitability, retest completion, remediation confirmation, and evidence that the same issue does not reopen in a later cycle. If the programme cannot prove those steps, it is generating activity rather than reducing risk.

Q: Who should own the response when offensive tests repeatedly uncover the same access flaws?

A: Accountability should sit with the teams that control the affected application, identity, or platform boundary, not with the testing provider. Repeated findings usually indicate a control gap in ownership, prioritisation, or change management, which means remediation must be tied to operational accountability and tracked through governance.

Technical breakdown

Why point-in-time penetration testing misses business logic risk

Point-in-time testing gives a narrow view of exposure because it samples one moment, one scope, and one set of assumptions. That works for compliance evidence, but it does not model how attackers iterate, return, or adapt when authenticated workflows exist. Business logic weaknesses are often invisible to scanners because they emerge only after login, role switching, or chained actions across APIs and web flows. Continuous testing helps close that gap by repeatedly exercising the same paths, so the control signal is freshness of validation rather than the existence of a single report.

Practical implication: treat annual penetration tests as evidence, not assurance, and add recurring tests for authenticated and workflow-dependent attack paths.

How AI changes the economics of offensive testing and attack timing

AI reduces the cost of reconnaissance, context gathering, and tailored exploitation, which means both defenders and attackers can iterate faster. That does not mean AI automatically creates deeper attacks, but it does lower the barrier to business-aware targeting and makes shorter remediation windows more realistic. In practice, the security problem shifts from rare, expert-driven probing to more frequent, cheaper attempts that can be repeated at scale. This changes how teams should think about patch latency, exposure duration, and the time between disclosure and exploitation.

Practical implication: compress remediation cycles around the exposures most likely to be probed quickly, especially internet-facing assets and authenticated business processes.

Why grey-box access remains important for modern offensive testing

Grey-box testing provides authenticated context, which matters because many high-impact flaws sit behind login, role, or workflow boundaries. Without credentials, testers can still find exposed surface area, but they may miss privilege transitions, access-control mistakes, and chained business actions that determine real risk. That is especially relevant for payment, banking, and card environments where the business value is inside the session, not on the public page. The key technical point is that contextual access changes the attack graph, revealing paths that unauthenticated testing cannot see.

Practical implication: include authenticated scopes in offensive testing where business logic, entitlements, or privileged workflows drive exposure.

Threat narrative

Attacker objective: The attacker wants to identify and exploit the most business-relevant weaknesses quickly enough to outpace routine remediation and control validation.

1. Entry occurs when attackers use low-cost AI assistance to identify exposed services, weak workflows, or externally reachable assets faster than manual review cycles can keep up.
2. Escalation follows when authenticated business logic, role transitions, or overexposed interfaces let the attacker move from surface probing into higher-value access paths.
3. Impact is the ability to execute targeted, business-aware attacks that bypass shallow testing assumptions and shorten the window between disclosure and exploitation.

NHI Mgmt Group analysis

Continuous offensive validation is becoming a governance control, not just a testing method. Iberia Cards’ model reflects a broader shift: organisations need repeated evidence that controls still work after changes, not just proof that they once worked. In regulated environments, the real issue is control decay between annual cycles. NHI Mgmt Group sees this as a governance problem because exposure windows, not audit timing, now define risk.

AI lowers attacker cost faster than most security programmes can reduce exposure. The article’s central warning is that attackers can now add context to reconnaissance and prioritise business logic more efficiently. That means the defender’s unit of measurement must move from coverage alone to detection and validation cadence. Programmes that still rely on sparse testing are effectively betting that exploitation will stay slow.

Business-logic-aware testing is where identity and application security meet. Authenticated flows, role transitions, and API access paths are where identity controls either hold or fail. This is where IAM, PAM, and offensive testing should converge, because access scope is only meaningful if it is tested in the workflows attackers can actually abuse. Practitioners should treat authenticated paths as first-class attack surface.

Shift-left and Zero Trust are no longer strategic preferences; they are timing controls. The article’s strongest implication is that shorter exploitation windows turn architectural goals into operational necessities. Zero Trust matters because it constrains trust at runtime, while shift-left matters because defects must be found before attackers scale. NHI Mgmt Group’s view is that timing now determines whether these programmes reduce loss or merely document it.

Recurrence creates the named control gap we can call testing cadence debt. When organisations rely on annual or point-in-time engagements, they accumulate unresolved exposure between tests, especially in regulated environments with frequent changes. That debt is not abstract. It shows up as stale assumptions, delayed detection, and missed business-logic flaws. Practitioners should measure whether their testing cadence matches their change cadence.

What this signals

The practical signal for security leaders is that testing cadence now needs to align with change cadence. When AI lowers the cost of repeated probing, a single annual engagement becomes an administrative milestone rather than a meaningful control.

Testing cadence debt: the longer the interval between offensive assessments, the more exposure accumulates in authenticated workflows, API chains, and workflow-dependent access paths. That is where identity and application security overlap most sharply, and where recurring validation becomes a programme design choice rather than a procurement detail.

For teams responsible for identity and access, the lesson is to treat session controls, role boundaries, and privileged workflows as testable surfaces. If those paths are not being exercised regularly, the programme may be compliant on paper while remaining slow to detect abuse in practice.

For practitioners

• Increase testing frequency for high-change assets Run recurring offensive tests on internet-facing applications, authenticated portals, and APIs between deeper annual or semi-annual engagements so exposure does not age unchecked.
• Include authenticated workflows in every critical test scope Require grey-box or credentialed testing for payment, banking, and admin workflows where role changes, session state, and chained actions determine real impact.
• Track remediation speed as a control metric Measure the time from finding to fix for externally reachable issues, because AI-driven adversaries compress the window between disclosure and attempted exploitation.
• Map offensive findings to Zero Trust boundaries Use test results to identify where trust is still implicit across APIs, sessions, and user roles, then tighten verification at those boundaries.
• Prioritise business-logic flaws over scanner noise Filter out repetitive low-value findings and focus remediation on issues that enable privilege misuse, authorisation bypass, or workflow abuse.

Key takeaways

• Point-in-time penetration testing is useful for evidence, but it is too sparse to provide real assurance in fast-changing environments.
• AI is lowering the cost of targeted, business-aware attack development, which makes faster validation and shorter remediation cycles more important.
• Identity, application, and offensive security teams need shared ownership of authenticated workflows, because that is where real exposure now concentrates.

Key terms

• Penetration Testing: Penetration testing is an authorised adversarial exercise that tries to exploit weaknesses the way a real attacker would. It validates whether a vulnerability, misconfiguration, or access weakness can become actual reach, escalation, or lateral movement.
• Gray Box Testing: A testing approach that gives the tester partial internal context such as credentials, documentation, or workflow information without full source code. It improves coverage and efficiency, but still leaves implementation details and some trust assumptions invisible.
• Business logic vulnerability: A business logic vulnerability is a flaw in how an application’s workflow or rules are enforced, allowing an attacker to misuse a process rather than break code directly. These issues often evade signature-based tools because the weakness lies in authorisation, sequence, or state handling.
• Testing Cadence Debt: The accumulation of unresolved exposure that builds when offensive security tests happen less often than the environment changes. It is a governance gap, not a tool failure, because it leaves assumptions stale between assessments and widens the window for abuse.

What's in the full article

Synack's full case study covers the operational detail this post intentionally leaves for the source:

• A practical account of how Iberia Cards compared AI pentesting with human researcher-led testing across real production assets
• The grey-box testing setup used for authenticated business logic and why credentials changed the depth of findings
• The CISO's operational criteria for deciding when AI pentesting is useful between deeper red-team engagements
• The reporting and traceability details that help regulated teams demonstrate control effectiveness to auditors

👉 The full Synack case study covers the testing model, the authenticated scope decisions, and the practical reporting lessons.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to broader security operations and access risk.