AI-assisted penetration testing with A.R.T.
AI-assisted penetration testing with A.R.T.
Adversarial Reasoning and Testing
A.R.T. works alongside our penetration testers during application assessments, investigating functions, roles and code in parallel to uncover more weaknesses and connect them into verified attack paths.
A penetration tester replies within one working hour with the questions needed to scope the engagement.
Included at no additional cost within the agreed engagement scope.
Overview
What is AI-assisted penetration testing?
A.R.T. is integrated into Adversify application penetration testing within the agreed scope. It supports live application testing and, where source code is provided, code review. The agents investigate in parallel, while the penetration tester oversees sensitive actions, validation and the final report.
This is for you if…
You want deeper investigation
Broader testing across the agreed scope of your application.
You want connected attack paths
Weaknesses joined up, and their practical impact understood.
You can share source code
Source-code insight combined with application validation.
New to the term? Penetration testing, defined in our glossary
Why you need it
Why does your organisation need AI-assisted penetration testing?
Application risk often sits in the connection between separate weaknesses. In the example below, an authorisation gap in the code and predictable order numbers in the running application combine to expose another client's records. A.R.T. helps investigate these connections across the scope you agree.
Illustrative scenario
01 Source codeLookup trusts any order ID
02 ApplicationOrder numbers run in sequence
03 ConnectedAny client's order can be opened
Business consequenceClient data exposed
Source code
The order lookup checks that a client is signed in, but not whose order they ask for.
Application behaviour
Order numbers follow a predictable sequence, so the next one is easy to guess.
Connected attack paths
Together, a signed-in client could open other clients' orders.
Business consequence
Other clients' names, addresses and orders could be read by anyone with an account.
Motive
Why does connected investigation matter?
A vulnerability's true impact may only become clear when it is combined with another weakness elsewhere in the application. A.R.T. supports focused investigation across code and application behaviour, while Adversify penetration testers oversee the work, control sensitive actions and verify every reported attack path.
Weaknesses span functions
Application weaknesses can span multiple functions and layers.
Two kinds of evidence
Source-code insight and application behaviour provide complementary evidence.
Connections show impact
Connecting weaknesses helps explain what an attacker could achieve.
Reach
What can AI-assisted penetration testing demonstrate?
In one anonymised assessment, A.R.T. connected several application clues to an exposed upload function. Testing demonstrated that an unauthenticated user could upload a file and retrieve it through the application. Adversify penetration testers verified the behaviour, evidence and practical impact before reporting it.
Anonymised assessment example
- Demonstrated
- Potential
Start
Unauthenticated starting point
Step
Application clues identify an upload capability
Step
Upload capability is investigated
Demonstrated
Unauthenticated file upload is demonstrated
Demonstrated outcome
The uploaded file is retrieved through the application
Verified by Adversify pentesters
Potential abuse scenarios
- Hosting or distribution of attacker-controlled content
- Support for further attacks
The finding
Demonstrated outcome. Unauthenticated file upload and retrieval through the application, verified by Adversify's pentesters.
Potential business impact. The weakness could have allowed the organisation's trusted infrastructure to be abused to host attacker-controlled content and support further attacks. This downstream abuse was not performed during the assessment.
Methodology
How Adversify runs an AI‑assisted penetration test
A.R.T. maps app features and inputs in the agreed scope. Our testers set the limits, oversee sensitive actions, check findings and own the report. They stay involved throughout, from initial scoping to final reporting, and answer for every conclusion made.
A.R.T. is multi-agent: coordinated AI agents performing focused investigations.
- Scope and controls
- Application understanding
- Focused agent investigations
- Application testing
- Authorisation review
- Input handling
- Connected findings and attack paths
- Verified Adversify report
Adversify pentester involvement throughout
Scope and controls
We agree scope, access, exclusions and testing controls with you, and which A.R.T. activities apply within the engagement. The boundaries are set out below.
- Scope
- Exclusions
- Testing controls
Application understanding
We begin by mapping the application's functions, exposed interfaces and sensitive workflows. This guides focused investigation towards the areas where a weakness could have the greatest practical impact, while keeping testing within the agreed boundaries.
- Functionality
- Exposed interfaces
- Testing sensitivity
Focused investigations
A.R.T. coordinates focused investigations, each testing relevant areas within the agreed scope. Code review is organised around functional flows and security concerns, such as authorisation and input handling, and candidate vulnerabilities are assessed for exploitability and existing protections.
- Application testing
- Authorisation review
- Input handling
Connected findings and attack paths
Code-review findings provide targeted leads for application testing, which helps assess whether suspected weaknesses can be exploited in practice, where feasible and within scope. Sensitive actions are held for review, and the Adversify pentester approves or denies each request.
- Attack paths
- Code to application
- Pentester approval
Verified Adversify report
Candidate findings undergo validation and pentester review. Pentesters assess the evidence and resulting risk, and the reviewed findings are incorporated into your Adversify pentest report.
- Validation
- Evidence review
- One report
Agreed boundaries govern AI testing
These controls govern how A.R.T. tests within the scope you agree.
Scope boundary
Client-defined scope and exclusions govern testing. Approval remains subject to agreed scope.
Request controls
Scope checks and request controls constrain agent actions, designed to prevent application content redirecting testing or causing unauthorised disclosure.
Environment safeguards
Environment-specific safeguards account for production and non-production testing.
Approve or deny
Sensitive actions are held for human review. The Adversify pentester assesses the proposed action within the agreed scope and approves or denies it.
How your data is handled is answered in the questions below.
Coverage
What does AI-assisted penetration testing with A.R.T. cover?
A.R.T. is integrated into applicable Adversify application penetration tests within the agreed scope. It supports live application testing and, where source code and suitable access are provided, code review. Scoping confirms the functions, environments, exclusions and controls governing its use.
AI application testing
Guided by the application's functionality and exposed interfaces. Focused agents test relevant areas within the agreed scope.
AI code review
Organised around functional flows and security concerns, such as authorisation and input handling. Requires source-code access.
Code and application together
Code-review findings give targeted leads for application testing, where feasible and within scope.
Scope and exclusions
The functions, environments and any exclusions from AI-assisted testing are agreed at scoping.
Your full manual pentest
Your planned manual testing remains in place alongside the A.R.T. investigation.
Delivered by Adversify
A capability our pentesters operate within your engagement, not software or a portal you license.
What you get
What you get from AI-assisted penetration testing
You receive one Adversify penetration test report containing all validated findings from the engagement. Our penetration testers review the evidence, assess the risk and remain accountable for every conclusion. Manual and A.R.T.-assisted findings meet the same standard for evidence, impact and reporting.
You receive
Findings validated by pentesters
Candidate findings undergo validation and pentester review before they are reported.
Evidence assessed
Pentesters assess the evidence and resulting risk of each finding.
One Adversify report
Reviewed findings are incorporated into your Adversify pentest report, in its existing format.
One verified Adversify report
Manual and A.R.T.-assisted findings are held to the same standard for validation, evidence, impact and reporting.
After the report
- Your team sees what connected weaknesses could let an attacker achieve
- Repeat testing is available as a separate engagement
Questions
AI-assisted penetration testing questions
Clients adding A.R.T. ask about scope, oversight, finding checks, repeat testing, compliance and data use. These answers cover each point. Our method sets out the controls, the tester's role and who remains responsible from scope to report on each test.
Not answered here? Ask it on the scoping call
Is repeat testing included?
Repeat testing is available as a separate engagement. A.R.T. is included within the scope of the engagement you agree, and it is not continuous monitoring or a recurring testing service.
What do we agree at scoping?
Your application testing scope and exclusions, where A.R.T. will support the assessment, the application access required and, where code review is included, suitable source-code access.
How are findings checked?
Findings are validated and reviewed by pentesters before they appear in your report. The verified report phase of the methodology sets out the steps.
Is our data used to train AI models?
Before testing, we agree what data may be processed, which providers are used, where it is stored, who can access it and when it is deleted. We use enterprise or API services configured so customer inputs and outputs are not used to train provider models, and use test data wherever possible. These controls are recorded in the engagement documentation.
Does AI-assisted penetration testing count for compliance?
A.R.T. is integrated within the applicable assessment. Whether an engagement meets a particular requirement depends on what your auditor, regulator or insurer asks for. Ask them, and tell us at scoping.
What do the pentesters do?
Our pentesters remain fully involved throughout the engagement. They approve or deny sensitive actions, review the evidence and own the report.
What happens next?
Include A.R.T. in your next Adversify engagement
Tell us about the application you want tested and whether source code is available. A penetration tester will reply within one working hour to discuss the scope, access, exclusions and controls for the engagement.
- Agree your application testing scope and exclusions.
- Agree where A.R.T. supports the assessment.
- Provide application access and source-code access where applicable.
Included at no additional cost within the agreed engagement scope.
A penetration tester will agree how A.R.T. supports the application assessment and the assurance you need.