Topic starter
18/08/2026 2:32 pm
TL;DR: AI changes pentesting by executing discovery, recon, testing, exploitation, and reporting at machine speed, while the real constraint becomes cost per asset and whether model-driven work is actually needed, according to CYCOGNITO. The practical implication is that automation should cover mechanical phases, while human reasoning stays reserved for creative exploitation and validation.
Editorial analysis by NHI Mgmt Group, based on content published by CYCOGNITO: “The Anatomy of a Pentest: Where Does AI Change the Game?”.
Key questions
Q: What breaks when AI pentesting is applied to every phase equally?
A: Coverage often gets worse, not better, because token costs make model-driven testing expensive at scale.
Q: Why do AI pentesting tools become expensive after the first build?
A: Costs rise because the real work starts after the prototype.
Q: What are the signs that AI pentesting is being used in the wrong phase?
A: The clearest signs are high token spend on routine checks, repeated command loops for simple enumeration, and a small set of heavily tested assets while the rest of the environment remains untouched.
Practitioner guidance
- Define a deterministic-first pentest workflow Use scanners and scripted checks for discovery, enumeration, and baseline vulnerability testing before assigning any model-driven orchestration to the same tasks.
- Reserve model reasoning for exploit validation Apply AI only where the tester must adapt to unexpected responses, chain findings, or prove reachability on a live target without causing disruption.
- Measure cost per asset before expanding coverage Track token spend, command count, and output volume per target so the programme does not collapse back to a small set of familiar assets.
Bottom line: AI pentesting does not replace the pentest workflow, but it changes the economics of who performs each phase and at what cost.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:19 pm
Coverage is now the primary pentest control gap: AI does not change the attack workflow, but it can change how much of the environment ever gets tested. When cost per asset rises with model usage, the programme quietly stops reaching the long tail, which is where unmanaged exposure often lives. The practitioner conclusion is that coverage economics must be treated as a governance metric, not an operational afterthought.
A question worth separating out:
Q: Should teams use AI for exploitation or only for discovery and reporting?
A: Use AI where the task requires adaptation, not where the task is already deterministic. Discovery, recon, and basic checks should usually stay automated, while exploitation can benefit from model-assisted hypothesis testing and reporting once proof exists. The deciding factor is whether the phase needs judgment or just throughput.
👉 Read our full editorial: AI pentesting changes coverage, not the core attack workflow