AI penetration testing

AI penetration testing

An AI pentest can mean two things. We run both. AI testing agents do the repetitive work under rules we set for your scope. We also test the AI features in your product.

How the AI part works

We split an engagement into tasks. AI testing agents run them in parallel, as each user role in scope. Each tool an agent can use has a rule for your scope: it runs on its own, waits for our approval, or is blocked. Out-of-scope hosts are blocked. File uploads and authentication checks can wait for approval.

What people do

An agent may report a finding only if it links to evidence: the request, the response and the controls. Then a person checks that evidence and writes the report. Testing is not automated-only, and no finding reaches you unchecked.

What an AI pentest covers

• Web apps and APIs: the same scope as a penetration test. Access control, sessions, injection and tenant isolation.
• AI features in your product: prompts, tools, agents and data paths. See AI red teaming.
• Recurring tests: we assess each release you ship, inside a scope agreed once.

Does AI testing lower the price?

No. The quote follows the scope. The agents run the repetitive requests, and people do the checking and the writing.

What to have ready

• The systems in scope and the hosts that are off limits.
• One test account for each role.
• The AI features, models and tools in scope, if any.
• The date you need the report, and who will read it.
• A named contact for the test window.

Where it stops

We test the systems you authorize in writing. We do not test internal networks or physical sites. We do not run social engineering against staff, and we do not run denial-of-service or load tests.

How an engagement runs

1. Scoping call. A short call about what you need, who will read the report and your deadline. We send a written scope and a quote.
2. Authorization. Testing starts only after the owner of each system signs written authorization. Do not send passwords or keys.
3. Testing. We test inside the agreed scope, with test-owned accounts and data.
4. Report. You get evidence, reproduction steps and a fix for each finding.
5. Retest. After you ship fixes, we can verify them. The quote states the retest terms.

Safety limits

• We test only with written authorization from the system owner.
• Destructive proofs use only accounts and records we create for the test, marked as test data.
• Tests of uploads, password guessing, email sending and paid third-party APIs have limits, and the report states what they cost.
• Reproduction scripts are read-only where possible.

What you get

A report in HTML, PDF and Markdown, with proof-of-concept scripts. Each finding has evidence, reproduction steps and a fix, and the report lists the controls that held. Read the sample report, written for a fictional app.

• Scope, assets and a four-level severity scale: Critical, High, Medium and Low
• An executive summary with priority actions
• One section per finding: description, impact, verified results, reproduction and fix
• Controls that held, so your fix does not break them
• A remediation plan, plus limitations and open questions

Proof from our own research

Each post below has a local fixture with real recorded requests and responses. The code is public in web-security-fixtures on GitHub.

• Authorization testing for APIs
• OWASP API Top 10: tests you can run
• IDOR: a local example with PUT and DELETE

Questions

Is an AI pentest fully automated?

No. AI testing agents run the repetitive requests. People check the evidence for each finding and write the report.

Can the agents touch systems outside our scope?

No. Out-of-scope hosts are blocked by rule. You sign the scope before any testing starts.

Do you test our AI features too?

Yes. See AI red teaming for LLM apps, agents and MCP servers.

How much does it cost?

We quote the scope in writing after a short scoping call. We publish no prices.

What do you need from us?

The systems in scope, one test account for each role, and written authorization from the system owner.

To see how a quote is built, read pricing. For the full method, read application security assessment.