Advanced: autonomous and agentic AI penetration testing.

What penetration testing is, in the standards

Before AI enters the picture, be clear what a penetration test is. The US National Institute of Standards and Technology (NIST) defines it in SP 800-115 (2008) as "security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network", often using the same tools and techniques as real attackers on real systems.

NIST sets out four phases:

• Planning: the rules are set, management approval is finalised and documented, and goals are agreed. No testing happens yet.
• Discovery: gathering information and scanning, then analysing what is found against known vulnerabilities.
• Attack: verifying suspected vulnerabilities by attempting to exploit them. NIST draws the key distinction: a scanner only flags that a weakness might be present, while this phase confirms it is real by attempting to exploit it.
• Reporting: which runs alongside the others and ends with the vulnerabilities, a risk rating and guidance to fix them.

The Penetration Testing Execution Standard (PTES) describes seven stages (pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, reporting). The OWASP Web Security Testing Guide is an open methodology for testing web applications. MITRE ATT&CK is a free, globally used knowledge base of adversary tactics and techniques drawn from real-world observations.

Two cautions from NIST that matter even more for autonomous tools:

• Systems may be damaged or made inoperable during a test, so it should be done only after careful consideration, notification and planning.
• A test confirms a weakness; it is not licence to cause harm. A test can be designed to stop before an action would cause damage.

NIST's control catalogue (SP 800-53, control CA-8) adds that penetration testing goes beyond automated scanning, is done by people with demonstrable skills, and that all parties agree the rules of engagement before testing begins.

Authorisation is the line

The single thing that separates a penetration test from a crime is authorisation: written permission, a defined scope, and agreed rules of engagement. This is true whether a human or an AI agent does the work.

• United States. The Computer Fraud and Abuse Act (18 U.S.C. § 1030) turns on access "without authorization or exceeding authorized access" to a protected computer. The law hinges on permission, not on the technique used.
• Rules of engagement. NIST SP 800-115 provides a template. It sets the scope, an exclude list of systems that must not be touched, criteria for halting the test, how data is handled, and a signed authorisation. For an external tester, NIST stresses ensuring proper authority is granted and keeping a signed copy. For on-site work it describes carrying a signed authorisation letter to show to security or police if challenged, the "get out of jail" letter in industry slang.
• Professional standards. CREST, a not-for-profit accreditation body for the security-testing industry, requires members to accept a code of ethics: comply with all applicable law, act with integrity, protect client information and avoid conflicts of interest.

In Kenya: the Computer Misuse and Cybercrimes Act, 2018 makes unauthorised access (section 14), unauthorised interference (section 16) and unauthorised interception (section 17) serious offences, with higher penalties for attacks on protected computer systems such as banking and payment systems (section 20). Crucially, section 18(3)(a) provides that using the relevant tools and access codes is not an offence where the act is, in the law's words, "intended for the authorised training, testing or protection of a computer system". In other words, authorised, scoped testing is lawful; the same actions without authorisation are a crime. Always have written authorisation and defined scope before any testing, and take legal advice.

What autonomous and agentic AI testing tools are

A new category of tools uses AI agents to carry out parts of an authorised test with varying degrees of autonomy: mapping the external attack surface, identifying weaknesses, generating a proof-of-concept to confirm a finding is real, and reporting. They are often marketed as acting "like an outside attacker", testing the perimeter an external attacker would reach first.

Named tools exist as examples, not recommendations; treat any vendor performance figures with caution:

• Open-source and commercial agents that run autonomous tests against applications or the external attack surface, aiming to ship each finding with a working proof-of-concept and to retest on every change.
• PentestGPT, an academic tool (presented at a major 2024 security conference), is the most useful public study of what large language models can and cannot do in penetration testing.
• XBOW, an autonomous tester, reported in June 2025 that it reached the top of a US bug-bounty leaderboard, submitting around 1,060 findings. Importantly, the company said a human security team reviewed the findings before submission, to meet the platform's policy on automated tools: human validation was kept.
• Google's Big Sleep, from Google Project Zero and DeepMind, reported finding a real, exploitable memory-safety flaw in a widely used database before it reached a release, so users were not affected: an example of AI used for defensive vulnerability research.
• The DARPA AI Cyber Challenge, a US government competition that ran to August 2025, had autonomous "cyber reasoning systems" both find and fix vulnerabilities in open-source software. In the final, the systems found 54 planted vulnerabilities and patched 43, and also discovered 18 real, unplanted vulnerabilities. It is the strongest official evidence that autonomous systems can find and patch real flaws at scale, framed as empowering human defenders.

Be careful with the labels: vendor claims about speed and false-positive rates are self-reported and should not be taken as fact. Some names in circulation could not be verified against any primary source; do not assume a tool exists or works as advertised without checking.

Running an authorised engagement with AI tools

An AI tester does not change the governance; it raises the stakes, because it can act faster and more autonomously than a person.

How these tools work, in plain terms. NIST describes an AI agent as software that repeatedly prompts a model, acts on its output by calling a tool, feeds the result back and iterates, sometimes with memory and planning. Mapped onto testing, the agent plans a step, runs a tool, observes the result and continues, through reconnaissance, attack-surface mapping, weakness identification and proof-of-concept to confirm a finding, not to weaponise it.

Governance essentials for an autonomous engagement:

• Authorisation and scope first, exactly as for a manual test: written permission, a defined scope and an explicit exclude list the tool cannot cross.
• Least privilege for the agent. The OWASP Top 10 for large-language-model applications names "excessive agency" as a risk: do not give the tool more autonomy, permissions or system access than the job needs.
• Halting criteria, so the tool stops before an action would cause damage or availability loss, following NIST's guidance.
• Human oversight. Findings must be validated by skilled people before they are acted on, because AI testers produce false positives and can invent findings.
• Protect the data. Information may leave to a cloud model; agree what may be sent, and remember NIST warns that agents themselves can be hijacked to run code or exfiltrate data.
• Logging and auditability of what the tool did, and reporting to management with risk-based priorities.

The agent is also an attack surface. Because an AI agent uses tools and reads untrusted input, it can be targeted by prompt injection and other attacks, and NIST notes that security research on agents is still early. An autonomous tester must be run as carefully as any other powerful tool pointed at your systems.

What AI testers can and cannot do

AI penetration testing is advancing fast, but the evidence is clear that it augments skilled testers rather than replacing them.

The PentestGPT study found that large language models are good at specific sub-tasks, using tools, interpreting their output and suggesting the next step, but struggle with the whole picture. Its findings, in plain terms:

• they can use testing tools and spot common vulnerabilities;
• they lose track of long context, which is vital for linking weaknesses into a chain;
• they favour the most recent task and go deep on one service, forgetting earlier findings;
• they produce inaccurate commands and hallucinate, sometimes inventing tools that do not exist;
• they lean on brute force and common techniques learned from reports, which are often the wrong choice.

The study concluded that these tools show real promise, but also mark the areas where human skill still surpasses the technology.

The practical limits to design around:

• False positives need human validation; the teams behind the leading autonomous testers keep a human in the loop.
• Scope and damage: an autonomous tool can do harm or drift out of scope faster than a person, so halting criteria and an exclude list are not optional.
• Data exposure to cloud models, and the risk of the agent being hijacked.
• Skills still matter: NIST requires testers with demonstrable skills, and AI does not remove that need; it changes what the skilled tester spends time on.

Used well, within authorisation and with human judgement, these tools let a team test more often and find more, while people decide what is real and what to fix. Used without authorisation, scope or oversight, they are both a legal and an operational hazard.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.