Attackers automated the patient part
Reconnaissance, pretexting and exploit assembly now run at machine speed. A quarter of malicious breaches last year had AI on the attacker’s side — a 56% jump in a single year.
AI & penetration testing
Attackers got faster. Your testing has to keep up.
AI is on both sides of this now. A quarter of malicious breaches last year were AI-enabled, and they cost about a million dollars more than the rest. Here is what AI genuinely changes about testing, what it still can’t do, and how to weigh what it’s worth to you.
In the attacker’s toolkit
1 in 4
malicious breaches were AI-enabled
$6M
average cost when AI was in the attack
100%
of findings confirmed by a human
portal.cyberlysecure.com/acme-health/coverage
Acme Health — Coverage this quarterMachine breadth · human judgment
Running- Surfaces watched24 of 24
- Re-tested on changeEvery release
- Candidates triaged1,204
- Confirmed by a tester37
Reached your engineers37 of 1,204
Nothing reaches you until a certified tester has confirmed it
Watching every release
False alarms filtered out
What changed
The gap between “tested” and “safe” got wider.
Nothing about your obligations changed this year. What changed is the speed on the other side of the fight, and how quickly your own estate moves underneath you.
Your estate changes every week
Cloud, SaaS and new features ship continuously. A report from last spring describes a system you no longer run.
More alerts is not more safety
Scanners produce volume. Without proof that something is genuinely reachable, your team spends its week sorting noise instead of closing risk.
AI is inside your stack too
Copilots, assistants and agents are part of your attack surface now, and most testing programs have never once looked at them.
Where AI helps
What the machines are genuinely good at.
These are the methods that have earned their place in offensive security — described by what each one is worth to you, not by the tooling behind it.
Agentic reconnaissance
Goal-directed agents map everything you expose and keep mapping it, across a surface far too large to walk by hand.
Attack-path reasoning
Not a list of weaknesses but the route that joins them — the way an attacker actually reaches your data.
Coverage between engagements
Your environment re-examined as it changes, so a gap opened by this week’s release doesn’t wait a year to be found.
Triage that cuts the noise
Thousands of candidate issues narrowed to the few that are real, reachable and worth your engineers’ time.
Social engineering as it is now
Your people tested against the AI-assisted pretexting and voice cloning attackers already use — safely, and only with your authorization.
Adversarial testing of AI itself
Prompt injection, tool abuse and memory poisoning against the AI features you ship. A different craft from testing a web app.
In the attacker’s hands
Six things machine learning made possible that were not before.
This is the part of the conversation that usually gets waved away as hype. It is not hype — it is published, peer-reviewed research, and every one of these has working code behind it. We test you against them because your attackers already read the same papers.
Payloads no rule book would write
Autonomous web-testing research now uses generative models to produce cross-site scripting and SQL injection payloads aimed squarely at getting past a web application firewall. Tested against Azure WAF and OWASP’s ModSecurity rules, 8% of generated samples went straight through. Eight percent sounds survivable until you remember that an attacker needs one.
Chowdhary et al., Sensors, 2023 · 8% bypassed a production WAF
Passwords your wordlist never held
Conventional cracking depends on a human choosing the right wordlist and writing the right mangling rules. PassGAN learns the distribution of real leaked passwords instead, and generates candidates those rules would never have produced. Its strongest result was not beating the classic tools — it was finding passwords alongside them that they missed entirely.
PassGAN · matched passwords rule-based tools never generated
Malware your scanner waves through
MalGAN and the work that followed it do not rewrite malware. They pad it with irrelevant, benign-looking features until a classifier stops objecting — driving the true-positive rate of a black-box detector toward zero. Worse for the defender, the generator learns faster than the detector can be retrained, so the gap does not close on its own.
MalGAN · true-positive rate driven toward zero in published tests
A face that was never anybody’s
Generative models can compose an attacker’s face with a target’s features until face verification accepts it. More unsettling still is the master-face work: EU-funded research generated a handful of synthetic faces that authenticated against a meaningful share of an entire population, with no knowledge of any individual. If your access control ends at a face, this is your threat model.
Master-face research · nine generated faces, one population
Adversarial samples at volume
Attack-inspired generative models produce an evasion sample in under a hundredth of a second, against more than three hours for the classical optimization methods. They need no gradients, which means they work against ordinary classifiers — random forests, not only neural networks — and they work from the outside. The same property that makes them dangerous makes them useful for testing your own models at scale.
AI-GAN · under 0.01s per sample, against 3+ hours classically
Lures written in your own house style
Generative models write the email, clone the voice and produce the video. Every tell your awareness training taught people to watch for — the odd phrasing, the wrong logo, the accent that did not fit — was a symptom of the effort an attacker used to have to spend. That effort is now a few minutes of compute.
Generative misuse · written, voiced and filmed in minutes
Every technique above is published, peer-reviewed research, cited here because it describes what your attackers can already do — not a CyberlySecure product. Sources include GAN-based autonomous penetration testing for web applications (Chowdhary et al., Sensors, 2023), PassGAN, MalGAN and its successors, EU-funded master-face research, and the AdvGAN / GAP / AI-GAN line of adversarial-sample work.
Where it doesn’t
A machine finds candidates. A person finds the truth.
Automation that reports confidently and wrongly doesn’t save your team time, it spends it. That is why everything we find ends with a certified human before it reaches you — and why the report carries their name.
How we work safely What no model will do for you
- A model doesn’t know which system your business cannot afford to lose.
- Confident and wrong is expensive — every invented finding costs an engineer a day.
- Multi-step attacks need someone who knows when to stop, and what not to touch.
- Nothing automated walks through a door, tailgates a badge line or talks past reception.
- Auditors and customers accept a signature from a named, certified tester — not a model version.
Cost & benefit
The numbers your budget holder will ask for.
Testing isn’t bought against a wish list, it’s bought against a risk. Here is the comparison in the terms finance actually weighs.
What testing costs
Published industry averages put a professional penetration test between roughly $10,000 and $30,000 in 2026, depending on scope.
What a breach costs
The global average reached $4.99M last year, up 12% — and about $6M when AI was part of the attack.
Where AI moves the maths
Machine breadth makes year-round coverage affordable: subscription testing is reported to run roughly 30% below traditional engagement pricing.
What you’re really buying
Not a document. The chance to close a gap on your schedule instead of an attacker’s — and the evidence that you did.
| What you care about | Once a year, by hand | Year-round, AI breadth + human depth |
|---|---|---|
| What changed since the last test | Waits for the next engagement | Re-examined as it ships |
| Breadth across a large estate | Sampled by hand | Machine breadth, human depth |
| What lands on your engineers | A report at the end | Confirmed findings, as they’re found |
| False alarms | Filtered by the tester | Filtered by the tester |
| Evidence for auditors | Signed attestation | Signed attestation, kept current |
| Cost shape | One large bill a year | Spread across the year |
Figures cited: IBM / Ponemon Institute, Cost of a Data Breach Report 2026 · OWASP Top 10 for LLM Applications (2026) and OWASP Top 10 for Agentic Applications · MITRE ATLAS · Cloud Security Alliance AI Controls Matrix · the EU AI Act. Penetration testing price ranges are published industry averages for 2026, not our pricing.
Find out what a year-round view of your estate would actually cost you.
Tell us what you need protected. You’ll talk to a tester, not a sales rep.