Jason Haddix Says AI Pentesting Will Reshape Human Testers’ Workflows
Summary
Jason Haddix argues AI pentesting can expand testing coverage but depends on human-developed methodology. Aikido cites testing benchmarks and a Doyensec evaluation reporting 49 verified vulnerabilities, while surveyed security leaders report gaps in manual testing.
Key points
- Haddix predicts that AI will perform 90% of penetration tests in the near future, changing human testers’ workflows rather than eliminating their role.
- In Aikido’s survey of 400 CISOs and engineering leaders, 79% worried vulnerabilities could slip between scheduled tests and 48% said findings were outdated on arrival.
- Haddix argues AI pentesting needs human-developed methodology; a generic instruction to find bugs is insufficient, while teams are codifying methods such as reconnaissance.
- In an Aikido benchmark, agents reportedly found a way to forge e-signatures in a document-signing app in about nine hours; a senior human team took about two weeks and did not find the forgery.
- Aikido reports that white-box testing across more than 1,000 AI pentests uncovered seven times more vulnerabilities than grey-box testing alone, with fewer attempts.
- Aikido’s report says half of surveyed leaders said manual testing often or always misses logic flaws, broken access controls, and multi-step bugs; the figure was 92% among teams shipping daily or faster.
- Doyensec evaluated Aikido on two randomly selected open-source apps, reporting 49 verified vulnerabilities, including nine high- or critical-severity findings, with a 4% false-positive rate.
Article Details
- Topic
- AI-assisted penetration testing and its effects on testing coverage, methodology, and human pentesters