The release of models like Anthropic’s Mythos has reignited a central question across the cyber-security industry: what role will artificial intelligence play in penetration testing? With machine learning models capable of finding flaws at scale and operating faster than any human, security professionals are examining whether automated tools will eventually replace human testers entirely.
Industry experts suggest that while AI is unlikely to replace human intelligence, it will profoundly augment it. Rather than an outright replacement, the relationship between AI and penetration testers is evolving into a collaborative partnership.
Speed, Scale, and Persistence
Artificial intelligence operates at a pace that no human being can match. Because AI systems do not require breaks, sleep, or downtime, they can work relentlessly once given an objective. In the context of CVE disclosures and red teaming, this offers distinct operational advantages:
- Exhaustive Scenario Testing: AI can rapidly assess an environment by testing all possible scenarios to uncover weaknesses.
- Streamlined Reconnaissance: Automated platforms can handle repetitive tasks, identify potential vulnerabilities, and speed up the initial phases of a security assessment.
- High-Volume Output: The techniques deployed by AI platforms are persistent, operating at a scale that uncovers numerous flaws quickly.
The Necessity of Human Validation
Despite the speed and scale offered by automation, finding a vulnerability is only the first step. Understanding how a flaw can be exploited, what an attacker could achieve with it, and the genuine risk it presents requires expert human oversight. AI-generated findings must be thoroughly validated for several reasons:
Context and Prioritisation
An infrastructure might host hundreds of vulnerabilities, but not every flaw exposes an organisation to the same level of risk. A CVE on an isolated system carries a different weight than one on a critical, internet-facing asset with privileged network access. If organisations are flooded with automated CVE disclosures without context regarding which pose the greatest threats, teams can easily become overwhelmed.
False Positives and Vulnerability Chaining
Automated security tools are known to produce false positives, and AI is no exception. Human penetration testers are essential for confirming whether a reported vulnerability can actually be exploited. Furthermore, experts are needed to understand how multiple minor vulnerabilities can be chained together to forge a path from an exposed system to sensitive data or critical infrastructure.
Managing Remediation Pressures
When AI enables organisations to uncover vulnerabilities more rapidly, internal teams often struggle to keep pace with patching and remediation. Fixing a CVE requires understanding its exact location, system exposure, active exploitation in the wild, and the potential impact that remediation might have on business operations.
For organisations lacking the internal resources to manage continuous assessments and patching alone, Managed Security Service Providers (MSSPs) can offer vital support. These external teams help businesses understand their actual exposure, prioritise critical vulnerabilities, and oversee effective remediation.
Ultimately, artificial intelligence is reshaping how penetration testers operate by boosting speed and effectiveness, establishing a working partnership built on automated persistence and human expertise.
