Topic starter
02/08/2026 12:23 pm
TL;DR: AI-assisted pentesting is now mainstream, PortSwigger reports, with 70% of surveyed researchers using AI tools and only 12% saying AI could replace humans entirely. Validation, chaining, and business-impact calls still decide whether a lead becomes a finding worth remediating.
Editorial analysis by NHI Mgmt Group, based on content published by PortSwigger: “The future of pentesting is Human x AI, and it's already in Burp Suite Professional”.
By the numbers:
- Only 12% of surveyed researchers believe AI could replace humans entirely, according to HackerOne research cited by PortSwigger.
- Bug bounty programs with AI in scope rose 270% year over year, according to HackerOne research cited by PortSwigger.
Key questions
Q: Why do AI tools still struggle with business logic vulnerabilities in pentesting?
A: AI often understands patterns in inputs and interfaces, but not the full business context behind a workflow.
Q: How should security teams use AI-assisted pentesting without losing control of evidence quality?
A: Use AI-assisted pentesting as a decision-support layer, not a decision authority.
Q: What fails when AI-assisted pentesting is not human validated?
A: The failure is not the AI output itself but the loss of judgment at the point where a candidate issue becomes a real security finding.
Practitioner guidance
- Define human validation gates for AI-assisted findings Require a named tester to confirm exploitability, reproduce the issue, and assign severity before any AI-generated finding is accepted into remediation workflow.
- Prioritise chained-impact scenarios for manual review Send multi-step paths, account takeover possibilities, and business-logic failures to experienced testers rather than relying on automation to grade them.
- Limit AI use to bounded workflow stages Use AI for summarisation, request drafting, and payload variation, but keep target selection, scoping, and final impact judgment with the tester.
Bottom line: AI-assisted pentesting has already become mainstream, but automation does not replace the contextual judgment needed to decide whether a finding matters.
Glossary terms: Human-in-the-loop verification, Stateful Exploit Chaining, Validation Gap, AI-Driven Pentesting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:23 pm
AI-assisted pentesting is now a governance problem, not just a productivity feature. The report data shows that AI has already moved into everyday testing behaviour, which means organisations are now deciding how to govern augmented testing at scale. The core issue is assurance quality, not tool adoption. Practitioners should treat AI-assisted testing as part of their security operating model, with clear rules for validation, escalation, and evidence quality.
A question worth separating out:
Q: What should organisations measure to know AI-assisted testing is working?
A: They should measure the share of AI-assisted leads that survive human review and become reproducible, material findings. High output with low validation quality means the programme is generating noise, while a strong verified-impact rate shows the human-in-the-loop process is doing its job.
👉 Read our full editorial: AI-assisted pentesting is now mainstream, but humans still decide impact