Episode 213: How AI Raises the Bar for Penetration Testing

 

 

In episode 213 of Cybersecurity Where You Are, Sean Atkinson and Ed Skoudis sit down with William Wright, Chief Executive Officer of Closed Door Security. They continue their conversation about penetration testing (pentesting) and artificial intelligence (AI), covering how AI affects generalist and specialist pentesters, which real-world AI-enabled capabilities pentesters are using, the costs of supporting an increasingly high bar for pentest engagements, and why Ed says the return on investment of AI in pentesting is survival.

Here are some highlights from our episode:

• 01:54. Generalist pentesters: Why they're more powerful than specialists most of the time
• 03:42. AI as a tool that doesn't replace generalists and specialists but makes them better
• 07:04. A new way for pentesting and red teaming: AI vs. AI and human vs. human
• 09:14. AI's inevitable incorporation into pentesting domains like web apps and mobile apps
• 14:36. How a fully autonomous triage agent supports Closed Door Security's human pentesters
• 16:06. How hallucinations, context rot, and "bad days" complicate AI-enabled pentesting
• 17:21. Financial and ethical considerations of running local models for penetration testing
• 18:52. How AI makes penetration testing more expensive yet limits price increases
• 21:16. The ROI of AI in pentesting? Survival. If you don't do it, you won't make it.
• 22:25. Drawing a distinction between "AI in the box" and AI-enabled human pentesters
• 25:09. How continuous pentesting with AI could blur the line between pentesting and vulnerability scanning budgets
• 27:05. Transparency: A central tenet of penetration testing, especially in the age of AI
• 28:35. How clients differ in their interest whether AI or human pentesters unearth a finding
• 31:30. Pentest results: Longer reports, more vulnerabilities of increasing complexity
• 36:20. How AI functions as an important training tool that gives new pentesters confidence

Resources

• Episode 201: The Evolution and AI Enablement of Pentesting
• Episode 212: The CIS Red Team — Testing via Collaboration
• CIS Red Team
• Penetration Testing
• Vulnerability Assessments

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].