Notifications
Clear all
Topic starter
18/08/2026 2:47 pm
TL;DR: AI will automate breadth work like surface mapping and known-pattern detection, but human researchers will remain essential for business logic, chained attacks, and novel AI-agent vulnerabilities, according to INTIGRITI. The practical shift is toward hybrid programs that use continuous scanning for scale and human creativity for depth.
NHIMG editorial — based on content published by INTIGRITI: CEO insights on holding the human layer sacred in the AI era
Questions worth separating out
Q: How should security teams combine AI with traditional AppSec scanning?
A: Use AI to improve triage, summarisation, and rule tuning while keeping deterministic SAST responsible for known vulnerability detection.
Q: Why do human testers still matter in AI-assisted security programmes?
A: Human testers still matter because the most valuable findings often depend on understanding how a product behaves, not just what it contains.
Q: What do teams get wrong about AI replacing vulnerability researchers?
A: They assume faster scanning equals complete assurance.
Practitioner guidance
- Define separate test lanes for breadth and depth Use AI-driven scanning for known patterns, dependency exposure, and baseline recon, then assign human researchers to business logic, chained abuse, and live-system interaction.
- Map AI agent interactions into security testing scope Treat AI agents as operational systems that can make decisions, call tools, and traverse trust boundaries, then test their delegated actions as part of application and identity reviews.
- Prioritise manual review for identity-heavy workflows Put human testers on authentication handoffs, role transitions, session boundaries, and privilege escalation paths where a scanner can confirm symptoms but not exploitability.
What's in the full article
INTIGRITI's full article covers the strategic detail this post intentionally leaves at a higher level:
- The CEO's full argument on why human hackers remain central to bug bounty economics.
- The article's broader view on how AI changes the cost structure of offensive security.
- Additional commentary on where AI helps and where it still falls short in real testing.
- Links to related Intigriti perspectives on AI, triage, and vulnerability discovery trends.
👉 Read INTIGRITI's insights on how AI is changing bug bounty and human research →
Human hackers in the AI era: what does it mean for bug bounty?
Explore further
18/08/2026 3:29 pm
Human creativity remains the deciding factor when attack paths depend on context. AI can accelerate discovery, but it cannot fully replicate the reasoning required to connect business logic, identity boundaries, and multi-system trust relationships. That means the organisations that over-automate offensive testing will still miss the issues that matter most. Practitioners should treat human-led research as a core assurance layer, not a legacy indulgence.
A question worth separating out:
Q: How should security teams govern AI agents used for offensive testing?
A: Treat offensive AI agents as distinct workloads with explicit ownership, scoped tools, and logged approvals. Give them only the environments, credentials, and actions needed for authorised testing. Separate research targets from production systems, and review retries, data access, and output handling as part of standard governance, not as an afterthought.
👉 Read our full editorial: Human hackers still define bug bounty in the AI era
