AI vs manual pentesting: what each does best
AI vs manual pentesting in one table: which task types suit an agent, which need human judgment, and how Excession Labs combines both in one test.
Short answer
Excession's model is AI-assisted testing. Incursion does the testing work under tool rules. Excession Labs agrees the scope, checks the evidence for each finding and writes the report. An agent is strong at breadth, repetition, role comparison and retesting. People are needed for business context, novel chains, risk acceptance and scoping.
Excession Labs delivers AI-assisted testing. Incursion, our testing agent, does the testing work under tool rules that you can see. Excession Labs agrees the scope with you in writing, checks the evidence for each finding, and writes the report.
This page describes our own delivery model. For a neutral comparison of providers, read the AI vs human pentesting guide on pentestcompare.com. Excession Labs publishes that guide, and the guide says so.
What does "AI-assisted" mean here?#
AI-assisted means an agent does the repetitive, wide testing work, and people keep control of scope, approvals and the final report. Three points define it.
- People set the limits. The scope is written, the owner authorizes it, and the operator sets which tools run on their own (allow), wait for approval (ask) or are blocked (deny).
- The agent works in parallel. A coordinator splits the job into tasks, and several workers run them at the same time.
- Evidence decides. A task is done only when each finding links to its evidence, and Excession Labs checks that evidence before it goes in the report.
How it works gives the full sequence.
Which task types suit an agent and which need a person?#
The table lists task types. It does not rate any provider.
| Task type | Agent strength | Where human judgment is needed |
|---|---|---|
| Broad coverage of many endpoints | Strong. It tries the same checks on every route without tiring. | Deciding which routes matter most to your business. |
| Repeated checks (headers, session handling, input handling) | Strong. Repetition is cheap. | Reading edge cases that do not fit the pattern. |
| Differential checks across roles | Strong. It replays the same request as anonymous, user, admin and a second account, and compares results. | Deciding what each role should be allowed to do. You supply the intended access model. |
| Cross-account authorization (IDOR-style) | Strong when two test accounts exist: it reads back the changed record from another session. | Judging whether a shared record is meant to be shared. |
| Retesting fixed findings | Strong. The original request is replayed and the control checks run again. | Confirming that the fix matches the intended design. |
| Reading client-side JavaScript for routes and keys | Good for finding candidates fast. | Judging which candidates are real exposure. |
| Business-logic flaws (price, quota, workflow order) | Limited. It needs your rules explained. | Needed. A person must know what "wrong" means for your business. |
| Novel multi-step chains | Limited. It can combine known steps. A new chain needs creative judgment. | Needed. |
| Severity and risk acceptance | Can propose. | Needed. Your team decides what risk to accept. |
| Scoping and authorization | Not the agent's job. | Needed. The owner authorizes in writing. |
| Social engineering, phishing, physical access | Out of scope for this service. | Not offered here. |
Where AI pentesting falls short covers the limits in more detail.
How does Excession Labs use both?#
We use the agent for volume and people for judgment, in three steps.
- Excession Labs holds the scoping call and writes the scope. You may share your access model, so that "should this role see this?" has a stated answer.
- Incursion plans and runs the tasks under the tool rules. It saves each request and response with a timestamp.
- Excession Labs checks the evidence for each finding and writes the report. A weak finding is removed or labeled as inferred at this step.
A scanner reports possible issues from signatures. The agent must show a real effect, such as a record changed and read back through another session. AI pentest agents vs DAST scanners explains the difference.
When should you ask for more human involvement?#
Ask for more human review when your main risk sits in business rules. Three situations call for it.
- The app handles money movement, approvals or entitlements with custom rules.
- Your main fear is a sequence of valid actions used in an unexpected order.
- A regulator or customer asks for a specific named method.
Tell us in the scoping call. The written scope states what the test covers and what it does not. We do not claim that the test finds all vulnerabilities, and we do not claim that your system is secure afterward.
What is the trade-off?#
An agent gives you breadth and repeatable retests, but your team knows what the application is for. Give us the intended rules for each role, and read the "Limitations and open questions" section of the report.
The free pentest pilot lets you see the work first, on a small written scope. Pricing lists what moves the cost. Safety sets out the limits on the agent. Incursion describes the agent itself. Human in the loop pentesting covers the review idea in more depth.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.
Questions
Is an AI-assisted pentest fully automated?
No. People agree the scope in writing, set the tool rules and approve actions that need approval. Excession Labs checks the evidence for each finding and writes the report. The agent does the testing work in between.
Does AI find everything a human tester finds?
No, and we do not claim that. Some issues need business context or a creative chain across several features. Those need human judgment. Read what the agent cannot do before you decide.
Should I choose AI-assisted or manual testing?
Match the test to the question. Broad coverage of many roles and endpoints, with retests, fits an agent well. A question about your business rules, risk appetite or social engineering needs people. Some programs use both.
Where can I compare AI pentest vendors?
Use the neutral guide on pentestcompare.com. It is published by Excession Labs and discloses that. This page covers how we deliver.
Run it on your application
Start with a scoped pilot. Incursion tests, a person checks each finding, and you get a report with evidence.