What is AI penetration testing? Three kinds, and what each can do

AI penetration testing is security testing of a web application or API in which an AI model plans, runs or reviews part of the work. The label covers three different kinds of product and service. Identify which kind you are looking at before you compare prices or results.

What are the three kinds of AI penetration testing?#

The three kinds differ in who chooses the next test and who decides that a result is real.

The kinds blend in practice: a vendor can sell an agent whose findings a human reviews. For each finding, ask who looked at the raw request and response before it reached you.

AI-enhanced scanners#

An AI-enhanced scanner is a vulnerability scanner that adds a model to a fixed engine. The model might write better payloads, group duplicate alerts, or explain a finding in plain words. The scan itself still follows a defined set of checks. OWASP describes dynamic scanners as black-box tools that inject payloads into a running application. AI pentest agents versus DAST scanners covers the difference.

Autonomous or agentic testers#

An agentic tester is a program in which a model runs a loop: it reads a response, picks the next request, calls a tool, and records what happened. A planner can split the engagement into tasks, and several workers can run the tasks at the same time. "Autonomous" describes the loop only. Real engagements add scope limits, tool rules and review around it. See how agentic testing is built.

AI-assisted human testing#

In this kind, a human pentester owns the engagement and uses AI tools for single tasks. Examples are reading a large JavaScript bundle, drafting a script, or summarizing a long response log. The human decides what to test and what to report, so the speed gain is real but limited by the human's time.

What can AI penetration testing do well?#

AI agents do best on work that is repetitive, well defined and checkable. They can repeat the same request across many roles, endpoints and parameters without tiring, read client-side code for hidden routes, and compare what an anonymous caller and a signed-in caller receive.

Authorization testing is a good fit because the procedure is mechanical: log in as two accounts, replay each request with the other account's identifiers, and compare. How AI agents test authorization has a worked example.

What can AI penetration testing not do?#

AI agents are weaker where the answer depends on context that is not in the traffic. Three limits stand out.

1. Business rules the agent cannot see. An agent does not know that a refund must never exceed the order total unless the rule is written down or visible in the app.
2. Novel attack chains. Chaining several small weaknesses into one impact still needs creative judgment. Agents sometimes manage it, but not reliably.
3. Proof discipline. Language models can state that a request "succeeded" when nothing changed. Without strict evidence rules, this produces false findings. See AI pentesting false positives and where AI pentesting falls short.

What do public benchmark results tell you?#

Public results show that AI agents can find real bugs, but each tests a specific target with its own scope. None tells you how an agent will do on your application.

Those benchmarks do not measure authorization and business-logic bugs in your application.

How does Excession Labs use AI in penetration testing?#

Excession Labs uses Incursion, a terminal AI agent for authorized security testing. A planner splits an engagement into tasks. Several workers run the tasks in parallel. Each tool has a rule: it runs on its own (allow), waits for approval (ask), or is blocked (deny). The operator sets the rules.

A task is done only when each finding links to its evidence. Excession Labs agrees the scope with you in writing, checks the evidence for each finding, and writes the report. How AI pentesting works walks through each step, and the example assessment shows a labeled example, including a rejected false positive.

For a market view of vendors, see the comparison of automated pentesting tools on pentestcompare.com. Excession Labs publishes that site and discloses it.

How should you evaluate an AI penetration test?#

Ask any AI pentest provider, including us, these four questions.

1. Who authorizes the scope, and how is it written?
2. Which actions run without approval, which wait for approval, and which are blocked?
3. What proves a finding: a status code, or a read-back of the changed state?
4. Who reviewed each finding before it reached me?

A benchmark score answers none of the four. To read the output, see how to evaluate an AI pentest report.