AI in Penetration Testing – the Use of Artificial Intelligence in Pentesting, Vulnerability Analysis and Security Automation

1. Introduction to the use of artificial intelligence in cybersecurity and penetration testing

• the role of artificial intelligence in modern penetration testing and the possibilities of using language models to accelerate vulnerability identification, threat analysis, and the automation of repetitive activities,
• the basics of how large language models (LLMs) work, the mechanisms of response generation, and the importance of tokens, the context window, and model parameters in the analysis of technical issues,
• limitations of the use of AI in pentesting, including model hallucinations, incorrect interpretation of results, generation of erroneous code, and the necessity of verifying responses,
• overview of AI tools used by cybersecurity specialists:
  • Claude.ai and other cloud-based language models,
  • Ollama and local AI models,
  • programming assistants and agents operating in the terminal,
• comparison of the use of local and cloud-based models in terms of data security, tool availability, performance, and possibilities of integration with the pentesting environment.

2. Prompt engineering for pentesters – advanced techniques of communication with AI models

• designing precise instructions enabling the use of AI for vulnerability analysis, interpretation of test results, script generation, and solving technical problems,
• creating prompts that take into account the infrastructure context, the technologies used, the scope of the authorized test, and the expected response format,
• advanced prompt engineering techniques increasing the effectiveness of security analysis and limiting the risk of generating incorrect results:
  • multi-step prompting,
  • Few-shot prompting,
  • role- and context-based prompting,
  • structuring responses in JSON and Markdown,
• using AI to develop hypotheses regarding potential vulnerabilities and to prepare plans for their verification,
• building your own library of prompts supporting individual stages of penetration tests, from reconnaissance to report preparation.

3. Reconnaissance and information gathering about systems using AI

• use of artificial intelligence to support the reconnaissance of IT infrastructure and the organization of information obtained during authorized penetration tests,
• supporting OSINT processes through the automatic analysis of publicly available information about technologies, domains, services, and infrastructure elements,
• analysis of information about detected services, ports, protocols, and software versions in order to identify potential risk areas,
• use of AI to interpret and correlate results coming from various diagnostic and pentesting tools:
  • Nmap,
  • Nuclei,
  • Burp Suite,
  • vulnerability scanners,
• automatic preparation of checklists and test scenarios based on identified technologies and system configurations,
• identifying dependencies between detected services and potential vulnerabilities in order to determine the next stages of testing.

4. Analysis of scan results and intelligent vulnerability prioritization

• use of AI models to process extensive scan reports and extract information relevant from the perspective of infrastructure security,
• automatic classification of detected vulnerabilities according to the type of threat, potential impact on the system, and the possibility of their exploitation,
• correlation of results coming from multiple security tools in order to detect recurring problems, dependencies, and potential vulnerability chains,
• supporting the identification of false positive results (false positives) and preparing procedures for confirming the actual occurrence of vulnerabilities,
• use of AI to analyze CVE data, CWE classifications, CVSS scores, and available information about vulnerabilities,
• creating vulnerability summaries together with the recommended order of further verification and remedial actions.

5. AI as an assistant during practical penetration tests

• use of AI during the execution of authorized test scenarios in an isolated laboratory environment, covering the analysis of the behavior of applications, services and security mechanisms,
• generation and modification of test input data and payloads used to verify vulnerabilities of web applications,
• analysis of HTTP server responses, error messages, headers and application behavior in order to identify irregularities and potential security issues,
• examining the effectiveness of application filtering and protection mechanisms, including WAF, and identifying the limitations of the applied protections in a controlled laboratory,
• supporting the creation of scripts and Proof of Concept (PoC) code used to confirm vulnerabilities in an authorized test environment,
• automation of repetitive activities related to response analysis, log processing and preparation of data for further verification,
• integration of language models with CLI tools in Kali Linux and Parrot OS environments and the use of AI to interpret command results,
• verifying the correctness of scripts and recommendations generated by AI and controlling the scope of activities performed during tests.

6. AI Agents and Automation of Security Testing Processes

• introduction to agent-based AI systems and the possibilities of their use in automating multi-step tasks related to the security assessment of applications and infrastructure,
• architecture of an AI agent including a language model, memory, external tools, planning mechanisms, and the loop for executing subsequent actions,
• use of the Model Context Protocol (MCP) to integrate AI models with development tools, file systems, and selected security tools,
• comparison of autonomous and semi-autonomous systems supporting penetration tests and defining areas requiring specialist supervision,
• designing simple agent-based workflows supporting the analysis of scanning results, vulnerability classification, and documentation preparation,
• mechanisms for limiting agent permissions, controlling executed commands, and approving actions potentially affecting the test environment,
• identifying the limitations of AI agents, such as uncontrolled action loops, excessive resource consumption, hallucinated results, and incorrect decisions,
• application of guardrails mechanisms, activity logging, and human control in security test automation processes.

7. Security analysis of source code and infrastructure configuration using AI

• use of language models to support security reviews of source code and identify dangerous constructs, implementation errors and potential vulnerabilities,
• analysis of code repositories taking into account dependencies between modules, data flow, authentication mechanisms and access control,
• supporting static application security testing (SAST) through interpretation of scanner results and classification of detected issues,
• identifying vulnerabilities related to improper data validation, permission handling, information disclosure and configuration errors,
• security analysis of infrastructure configuration described as code (Infrastructure as Code):
  • Terraform,
  • Kubernetes,
  • Dockerfile and container configurations,
• supporting analysis of unknown code and basic reverse engineering processes by explaining the operation of functions, dependencies and program fragments,
• generating security fix proposals and verifying their impact on the functionality and resilience of the application,
• comparing code before changes and after their introduction in order to assess the effectiveness of vulnerability removal.

8. Automation of penetration test results reporting using AI

• use of artificial intelligence to transform raw test results, technical notes and logs into structured security documentation,
• automatic development of descriptions of detected vulnerabilities covering the nature of the problem, the conditions of its occurrence, possible consequences and recommended remedial actions,
• preparation of technical reports containing information about vulnerabilities, methods of their confirmation, technical evidence and recommendations,
• creation of management summaries presenting test results in the context of business risk, impact on the organization and action priorities,
• adjusting the level of detail and the language of the report to technical recipients, administrators, development teams and management staff,
• automatic organization of documentation, standardization of naming, formatting of tables and preparation of multilingual versions of reports,
• use of AI for checking the consistency of documentation, detecting missing information and identifying potential inconsistencies between results and recommendations,
• integration of the documentation process with individual stages of the penetration test and reduction of the time needed to prepare the final report.

9. Security of applications using LLMs – AI Red Teaming

• introduction to security testing of applications using generative artificial intelligence, language models and autonomous agents,
• discussion of threats classified in the OWASP Top 10 for LLM Applications and their significance for organizations implementing AI solutions,
• analysis of prompt injection vulnerabilities and mechanisms for manipulating the behavior of language models through appropriately prepared instructions,
• identification of threats related to the disclosure of confidential information, improper access control and processing of sensitive data,
• analysis of risk resulting from excessive permissions of AI agents and uncontrolled execution of operations on external systems,
• security assessment of systems using Retrieval-Augmented Generation (RAG), including vulnerabilities related to data poisoning and manipulation of knowledge sources,
• overview of tools and methods supporting the security assessment of language models and the resilience testing of AI applications,
• identification of threats resulting from the use of AI by cybercriminals:
  • AI-assisted phishing and social engineering,
  • Deepfakes and impersonation of users,
  • Shadow AI and unauthorized AI tools in the organization,
• designing security measures for AI applications, including access control, permission restriction, data filtering and monitoring of model activities.

10. Legal, organizational and ethical aspects of using AI in pentesting

• defining the scope of authorized penetration tests, the rules for obtaining the system owner's consent and documenting permissible activities,
• analysis of the risk associated with providing AI models with customer data, fragments of source code, infrastructure configurations and security test results,
• requirements regarding the protection of personal data and confidential information when using local and cloud language models,
• the significance of GDPR, NIS2/KSC, DORA and the AI Act regulations for organizations using AI in security processes,
• developing principles for the safe use of AI by cybersecurity teams and specialists conducting penetration tests,
• defining human responsibility for decisions made on the basis of analysis results generated by AI models,
• comparison of local and cloud models in terms of security requirements, confidentiality, access control and compliance with the organization's policy.

11. AI implementation plan for the daily work of the penetration testing team

• identifying security testing processes in which the use of AI can bring the greatest benefits in terms of time savings, automation and quality of analysis,
• defining the principles for selecting AI tools appropriate to the specifics of the infrastructure, security requirements and the scope of the tests carried out,
• preparation of a plan for the gradual implementation of AI solutions in the pentesting team:
  • 30 days: selection of tools, preparation of the environment and first applications of AI,
  • 60 days: automation of selected analytical and reporting processes,
  • 90 days: integration of tools, evaluation of effectiveness and development of work standards,
• defining indicators of the effectiveness of AI use, covering analysis time, reporting quality, number of false indications and degree of automation,
• summary of the possibilities, limitations and good practices of the safe use of artificial intelligence in penetration testing.