Notifications
Clear all
Topic starter
02/08/2026 12:23 pm
TL;DR: AI-assisted pentesting has crossed into mainstream practice, with HackerOne reporting that 70% of surveyed researchers now use AI tools and AI-in-scope bug bounty programs rising 270% year over year, while only 12% think AI could replace humans entirely according to HackerOne’s 2025 report. The real governance question is how to preserve validation, context, and exploit-chaining judgment as automation scales.
NHIMG editorial — based on content published by PortSwigger: The future of pentesting is Human x AI, and it's already in Burp Suite Professional
By the numbers:
- AI-in-scope bug bounty programs jumped 270% year over year.
- Only 12% believe AI could replace researchers entirely.
- Burp AI is growing at around 25% month over month.
Questions worth separating out
Q: How should security teams use AI-assisted pentesting without losing control of evidence quality?
A: Use AI-assisted pentesting as a decision-support layer, not a decision authority.
Q: Why do AI tools struggle more with exploit chains than with simple vulnerabilities?
A: AI is strong at pattern recognition, so it can often identify surface-level issues that resemble known flaws.
Q: What breaks when pentest teams trust AI-generated findings too early?
A: Teams tend to overreport weak results, miss context-dependent abuse, and under-test complex identity or session flows.
Practitioner guidance
- Define where AI is allowed in testing workflows Document which stages of recon, payload generation, validation, and reporting can use AI assistance, and require human sign-off before any finding is treated as verified evidence.
- Prioritise manual validation for account takeover paths Use AI to expand coverage, but force human review for any chain that touches login, session, MFA, privilege escalation, or delegated access.
- Separate discovery from disclosure thresholds Set a higher bar for reporting when a finding is based on AI-assisted analysis, and require reproducible steps, impact notes, and environment-specific context before escalation.
What's in the full article
PortSwigger's full article covers the workflow detail this post intentionally leaves for the source:
- Burp AI usage examples inside the tester workflow, including how AI is invoked and reviewed
- The specific ways PortSwigger describes human control over context sharing and validation
- Cristi Vlad's account takeover example, including how separate issues were chained into a higher-impact finding
- The linked watch content and commentary around how Burp AI fits into daily pentesting practice
👉 Read PortSwigger's analysis of AI-assisted pentesting and Burp AI →
AI-assisted pentesting is mainstream now, but what stays human?
Explore further
02/08/2026 1:23 pm
AI-assisted pentesting is now a workflow issue, not a novelty. Once 70% of researchers are using AI in testing, the question shifts from adoption to governance. Teams need to decide where AI can accelerate work and where human validation must remain mandatory, especially around authentication, session handling, and exploit chaining. The security value comes from control, not from novelty.
A question worth separating out:
Q: Should organisations require different controls for AI-assisted security testing?
A: Yes. AI-assisted testing should have explicit rules for data sharing, approval, validation, and reporting thresholds. Organisations should also separate productivity metrics from assurance metrics, because more output does not equal better security. The safest model is supervised augmentation with clear accountability at every stage.
👉 Read our full editorial: AI-assisted pentesting is now mainstream, but humans still decide impact
