PortSwigger’s Advent of Cyber support underscores AI-assisted AppSec training

At a glance

What this is: This is a PortSwigger note supporting TryHackMe’s Advent of Cyber, with the key finding that hands-on practice and AI-assisted testing are being framed as complementary in AppSec training.

Why it matters: It matters to AppSec, IAM, and broader security teams because AI-assisted tooling changes how practitioners learn, validate, and scale testing without changing the need for control over evidence and findings.

👉 Read PortSwigger’s note on AI-assisted AppSec learning and Advent of Cyber

Context

AI-assisted application security testing is becoming more common, but the governance question is not whether tools speed up work. It is whether teams can preserve control, interpret results correctly, and keep human review central when automation helps with repetitive analysis. This article is primarily about AppSec training, not identity security, but it still touches the same operational discipline that underpins trustworthy security work: understanding what a tool can and cannot decide.

PortSwigger’s support for Advent of Cyber is a signal about how the industry is normalising practical, guided learning around real attack patterns. The mention of BurpAI matters less as a product claim than as a marker of how testing workflows are changing, with automation increasingly used to shape variations, validate findings, and reduce manual effort. That shift is relevant to teams responsible for secure development, security validation, and control assurance.

Key questions

Q: How should AppSec teams use AI tools without losing control over findings?

A: Treat AI as an assistant for repetition, suggestion, and formatting, not as the decision-maker. Analysts should still verify exploitability, scope, and evidence manually before they open a ticket or recommend remediation. The boundary needs to be explicit so speed does not replace judgment or produce false confidence.

Q: Why do request manipulation skills still matter in web application testing?

A: Because many access-control flaws only become visible when you change a request and compare the application’s response. Object-level authorisation failures, session mistakes, and backend trust gaps often hide behind normal workflows. If testers cannot alter and replay requests, they will miss the proof needed to confirm real exposure.

Q: How do teams know whether AI-assisted AppSec is actually helping?

A: Look for findings that can be traced back to named components, repeated across assessments, and mapped to concrete remediation actions. If the system produces faster output but reviewers still cannot understand why a requirement exists, the programme has improved throughput without improving governance.

Q: What should security teams do to build practical AppSec skills?

A: Use guided labs and realistic attack exercises that force people to inspect traffic, reason about application behaviour, and explain why a control failed. The best training makes practitioners prove they understand the path from request to impact, because that is what real testing and incident review require.

Technical breakdown

How AI assistance changes web testing workflows

AI assistance in application security usually helps with repetitive reasoning steps, such as generating request variants, comparing responses, or summarising likely next tests. That does not make it a decision-maker. The practitioner still needs to understand HTTP structure, application state, and why a response difference matters. In practice, AI can reduce time spent on mechanical variation while leaving interpretation, proof, and escalation in human hands. The core value is throughput, not autonomy.

Practical implication: use AI to accelerate exploration, but keep validation and final judgment with a trained tester.

Why request manipulation still matters in modern AppSec

Web attacks often succeed because small request changes reveal broken assumptions in access control, session handling, or backend trust. IDOR, for example, is not just about changing an identifier. It is about proving that the application fails to enforce object-level authorisation. Tools like Burp remain useful because they let practitioners edit, replay, compare, and trace those differences with precision. The underlying lesson is that secure testing depends on understanding application behaviour at the request level.

Practical implication: prioritise request-level testing for authorisation flaws instead of relying on surface scanning alone.

What hands-on learning contributes to control assurance

Hands-on exercises help security teams connect theory to actual attack paths. A challenge that starts with traffic inspection and ends with exploitation teaches more than a checklist because it shows how defensive controls fail in sequence. That is especially important when AI tools are present, because practitioners still need to know how to recognise evidence, verify impact, and avoid false confidence. Practical skill remains the basis for defensible security outcomes.

Practical implication: combine structured labs with live testing practice so teams can recognise failures, not just names of vulnerabilities.

NHI Mgmt Group analysis

AI-assisted testing is becoming a workflow accelerator, not a substitute for security judgment. PortSwigger’s framing reflects a wider shift across AppSec: automation can shorten the time to iterate, but it cannot decide whether a finding is real, exploitable, or material. The practitioner still owns validation, context, and remediation priority. The durable lesson is that AI should support testing throughput while preserving human accountability.

Request manipulation remains the decisive skill in application security. The article’s emphasis on web attack forensics, IDOR exploitation, and cURL-based request crafting points to a control reality that scanning alone misses. Broken authorisation often lives in the gap between intended policy and actual request handling. Teams that cannot inspect and alter requests will miss the evidence needed to prove exposure.

Hands-on training creates stronger security assurance than passive learning. Advent of Cyber is useful because it forces practitioners to observe how an attack progresses, not just memorise the label of the vulnerability. That matters for AppSec governance because controls are only credible when teams can reproduce and explain failure conditions. The practitioner takeaway is to test skills against realistic behaviour, not simplified theory.

AI in AppSec should be governed like an assistive capability with bounded trust. BurpAI is presented as a way to validate findings and shape cleaner payloads faster, which is exactly where governance matters most. The issue is not whether the tool can help, but whether teams define where machine assistance ends and human sign-off begins. Organisations should treat AI testing support as an augmenter, not an authority.

What this signals

Hands-on AppSec training is becoming more valuable as AI-assisted tooling compresses the time between hypothesis and test. The programme signal for security leaders is straightforward: teams will need stronger testing discipline, clearer review boundaries, and better evidence standards if they want automation to improve outcomes rather than inflate activity. For teams working across identity and access control, the same principle applies to authorisation validation and privilege review.

Assisted testing gap: as tools take over repetitive request manipulation, the differentiator becomes whether practitioners can still explain why a finding matters and how it was proven. That makes training design, not tool adoption, the governance issue. For readers with identity responsibilities, the closest parallel is access review quality: speed helps only if decision-making remains defensible.

For practitioners

• Strengthen request-level testing discipline Build lab and production testing routines that require testers to inspect, edit, replay, and compare HTTP requests before a finding is accepted. Focus on object-level authorisation, session behaviour, and response diffs, not only scanner output.
• Define human sign-off for AI-assisted findings Set a rule that AI-generated payload suggestions, summaries, or variations may accelerate testing, but a human must confirm exploitability, scope, and business impact before remediation tickets are raised.
• Use challenge-based training to close skill gaps Incorporate hands-on exercises on web attack forensics, IDOR exploitation, and log analysis so teams can connect attack behaviour to defensive controls and evidence handling.
• Measure whether tooling improves analyst throughput Track time to validate a finding, number of request variants tested, and percentage of cases where automation reduced manual repetition without reducing evidence quality.

Key takeaways

• AI-assisted AppSec tooling can speed up repetitive testing, but it does not replace human validation or control judgment.
• Request manipulation remains central to proving authorisation flaws, especially when web attacks hide behind normal application behaviour.
• Teams should govern AI testing aids as bounded assistants, with explicit human sign-off for exploitability, scope, and impact.

Key terms

• Request Manipulation: Request manipulation is the practice of modifying HTTP requests to test whether an application enforces access, validation, and state controls correctly. It helps testers prove whether a vulnerable path is real, because the response to a changed request often reveals broken authorisation or insecure backend assumptions.
• Web Attack Forensics: Web attack forensics is the process of analysing application traffic and server behaviour to understand how an attack unfolded. It combines request inspection, replay, and response comparison so practitioners can reconstruct exploit steps, identify failed controls, and document evidence in a defensible way.
• AI-assisted development: A development workflow where an AI system helps generate, refactor, test, or execute code inside the software delivery process. The security issue is not the assistance itself, but that the tool may operate in trusted contexts that also contain credentials, infrastructure access, and other sensitive assets.

What's in the full article

PortSwigger’s full post covers the practical event support and Burp Suite workflow detail this post intentionally leaves for the source:

• The prize package details, including 5 Burp Suite Professional licences with BurpAI and 100 certification exam entries.
• The specific Advent of Cyber challenge categories mapped to web testing skills, including web attack forensics and IDOR exploitation.
• The explanation of how BurpAI is positioned to help validate findings, shape payloads, and reduce repetitive manual work.
• The broader context behind PortSwigger’s view of AI as an everyday part of the pentester toolkit.

👉 PortSwigger’s full post covers the challenge themes, BurpAI role, and prize details for Advent of Cyber.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security operations and assurance.