Autonomous AI pentesting is an offensive testing approach in which agents conduct part of the investigation, formulate hypotheses, and adapt their next steps to the environment's responses. In manual pentesting, this direction depends primarily on the specialist. Both approaches must demonstrate an exploitable vulnerability, explain its impact, and produce evidence that guides remediation.
The difference lies in how the work is performed, repeated, and supervised. When choosing an approach, consider the surface to be tested, available access, the depth required, and how quickly the environment changes.
The objective of pentesting remains risk validation
An alert about a suspicious configuration is a starting point. Penetration testing investigates whether that condition enables improper access, unauthorized changes, or another meaningful impact. It may require combining weaknesses that appear minor in isolation.
This logic already appears in the NIST SP 800-115 guide: penetration testers simulate attacks and may combine vulnerabilities to gain additional access. The document also covers planning, evidence, and communicating results. AI changes how part of this work is performed; the commitment to validation remains.
Autonomy, automation, and AI assistance
Three different situations are often given the same label: "AI pentesting." In automated execution, the system runs through programmed checks. With AI assistance, the specialist uses a model to support analysis and content production. In an autonomous architecture, agents also make decisions during the investigation, within the boundaries defined for the operation.
The autonomy relevant to a pentest involves observing the authorized target, proposing a hypothesis, testing it, interpreting the result, and deciding whether it makes sense to continue down that path. A conclusion must be supported by evidence from the environment, with review when necessary.
This distinction helps evaluate a solution: understand which decisions it makes during testing and how those decisions can be monitored and interrupted.
Autonomous and manual pentesting in practice
| Aspect | Manual penetration testing | Autonomous AI pentesting |
|---|---|---|
| Investigation direction | The specialist selects and adjusts paths with automation support. | Agents make some of the decisions, with defined scope and oversight. |
| Environment context | It is built by the penetration tester using access, responses, and business information. | It must be provided or discovered during testing; roles and rules remain essential. |
| Repeating the tests | It depends on availability, the effort required, and procurement. | Can make repeat runs and retesting easier, depending on the operation and agreed boundaries. |
| Evidence | They should make it possible to understand and reproduce the validated path. | They must demonstrate the target's actual behavior, beyond the agent's interpretation. |
| Human role | Conduct the test and assess impact, priorities, and fixes. | Define objectives, oversee limits, and review context, impact, and decisions. |
A manual pentest can offer excellent depth and automation. An autonomous test can explore paths that depend on context. The quality of both depends on scope, execution, and the evidence delivered.
An example: the same API, two access roles
Consider a fictional portal where two companies access their own invoices. The API responds normally for both users, but a combination of identifier and permission may expose an invoice from the wrong company.
The test needs to understand tenant separation, compare behavior across authorized roles, and demonstrate the violation using test data. The problem may exist even with up-to-date components. This is a case where interpreting authorization context makes a difference.
A specialist can conduct this investigation. An autonomous architecture can also test such hypotheses, provided it has suitable access and maintains operational limits. OWASP describes this class as broken object-level authorization, or BOLA.
How to evaluate the right approach for your environment
- Surface and roles: which applications, APIs, integrations, and access levels will be tested?
- Depth: does the deliverable show attack paths and impact, or only suspicious conditions?
- Frequency: how do new releases and permission changes enter the next assessment?
- Traceability: is it possible to understand what was tested, with which access, and what the result was?
- Remediation: who receives the finding, how is it prioritized, and how will it be retested?
Continuous pentesting organizes this recurrence. Meanwhile, autonomous testing coverage depends on the paths and contexts the investigation can reach.
How Vultus applies this vision in Ares
Ares combines a multi-agent adversarial architecture with Vultus's proprietary harness, built on more than 18 years of experience and our Red Team's TTPs. The harness orchestrates agent execution and the use of testing tools within the operation.
This foundation connects offensive discovery, hypotheses, and evidence to operations within an authorized scope and under human supervision. Specialists remain responsible for turning technical impact into business priorities.
Explore Vultus's AI pentesting approach and see attack paths demonstrated in the series ARES KILLCHAINS BREAKDOWN.
