John Strand on AI’s Role and Limits in Penetration Testing
· 1:22:57 · Watch on YouTube ↗
Summary
John Strand argues that AI can accelerate penetration testing but cannot replace human judgment, verification and remediation. He describes AI-assisted API testing, expanding application attack surfaces and the need for compensating controls.
Key points
- Strand argues that AI-generated findings still require manual verification, organizational context and removal of false positives.
- He describes an AI-assisted test that fuzzed an exposed API, identified its framework and obtained an error containing default credentials in under 20 minutes.
- Strand says AI-generated applications can expand the attack surface while bypassing established change-management and security-testing practices.
- He discusses LLM-assisted analysis of endpoint detection and response blind spots, and recommends collaboration with security vendors to strengthen defenses.
- Where patches are unavailable, testers should help customers evaluate compensating controls such as firewall or IPS rules, segmentation and restricted cloud access.
- Strand recommends using existing security tools within AI workflows rather than having AI recreate functions such as port scanning.
Article Details
- Topics
- [00:21] AI and the future of penetration testing
- [11:24] Human-guided AI security testing
- [18:22] Dashboard overload and the need for contextual verification
- [34:14] LLM-assisted EDR analysis and evasion
- [44:27] Supply-chain attack scenarios and testing methodology
- [48:20] AI-assisted API testing and remediation bottlenecks
- [54:06] Compensating controls and AI workflow engineering
- AI-generated applications and expanding attack surfaces
People
Adam ChesterAuthored the Spectre Ops article on LLM-driven analysis for endpoint detection evasion discussed in the webcast.Bo BullockIdentified as the creator of Cloud Schism, used for continuous testing and Azure security findings.John StrandWebcast presenter who discusses AI-assisted penetration testing, security operations and remediation.