Home / AI-assisted penetration testing
Optional AI-assisted penetration testing
AI-assisted testing is an option you can add to any WhatsExposed test. AI tooling takes on routine work such as mapping and change detection, while a certified tester still leads the test and confirms every finding. It’s off unless you opt in, and opting in costs nothing extra.
What does AI do, and what do our testers do?
| Stage | AI-assisted tooling, if you opt in | Certified tester and Team Lead |
|---|---|---|
| Discovery | Maps what you expose and spots new systems as they appear | Checks the map against the scope you approved |
| Testing | Tests for known weaknesses and misconfigurations | Exploits issues by hand, chains them into attack paths, tests business logic and access control |
| Validation | Groups similar results | Confirms each finding is real and removes false positives |
| Reporting | Drafts the first version of each finding | Rewrites it for your team, then a Team Lead sets severity and signs the report |
| Retesting | Reruns checks once you mark a fix | Confirms the fix and approves the retest result |
Why do some clients opt in?
Attackers already use AI to find and exploit weaknesses. With AI tooling on our side, changes to your systems are spotted and handed to a tester sooner, and repetitive checks come off the testers so more of their time goes on the attack paths that need a person.
Why not rely on AI alone?
Fully automated tools miss attacks that need judgment, such as chaining two low-risk issues into a serious one, or one customer reaching another customer’s data. They can also report issues that aren’t real. PCI DSS Requirement 11.4 asks for a qualified tester independent of your IT team, and most SOC 2 auditors and insurers expect the same.
It’s off unless you opt in
We agree it with you in writing at the start, and you can change your mind at any time. Without it, our testers do the work by hand. Your report is led and signed by a certified tester either way.
How is your data handled?
We’re certified to ISO/IEC 27001:2022, and only the people on your engagement can see your findings. Our AI usage policy approves a single enterprise AI provider under a data processing agreement with zero data retention. Restricted client data is never entered into any AI service without your written approval.
AI penetration testing questions.
What is the difference between AI-assisted and autonomous penetration testing?
Autonomous testing runs without a person checking each result. AI-assisted testing uses the same kind of tooling for coverage, then has a certified tester confirm and sign off every finding.
Will an auditor accept an AI-assisted penetration test?
Yes, when a qualified, independent tester performs and signs the test, which is how we work. What auditors question is an automated report with no tester behind it.
Is AI testing safe to run on live systems?
Testing only runs against systems you’ve approved in writing. Anything that could disrupt a live system is done by a tester, in a window you agree.
Do you test AI tools like Microsoft Copilot as well?
Yes. We test what Copilot and other AI assistants in your business can see and leak, including overshared files and risky prompts.
Your choice on AI. A tester’s signature on every finding.
Opting in costs nothing extra.