In short
An AI pentest is a penetration test in which artificial intelligence agents automate part of the offensive work (reconnaissance, analysis, attack hypotheses, reporting) under the control of a human penetration tester who validates every finding, supervises risky actions and signs the report. At HackHeart, this hybrid approach covers more attack surface in less time without sacrificing the reliability of a manual assessment.
Why AI changes penetration testing
A traditional pentest is bounded by time. On a five-day engagement, a large share goes into repetitive work: enumeration, triaging tool output, reading HTTP responses, formatting the report. Large language models can now read source code, interpret server responses, suggest exploitation paths and document a finding. Used well, they free human time for what matters most: business logic flaws, creative attack chains and impact analysis.
Used without control, they also produce false positives, invented vulnerabilities and occasionally actions that harm production. That is why HackHeart does not sell a "fully automated pentest" but an augmented pentest: AI is the accelerator, the certified tester is the guarantor.
From 214 tested entry points to one proven vulnerability
The value of an AI pentest is not how many alerts it raises but what it rules out. Each stage filters the previous one, and only what a human has reproduced reaches the report.
- 214entry points exploredreconnaissance agents
- 11attack hypotheses testedanalysis agents
- 2findings sent for counter-reviewadversarial agent
- 1vulnerability reproduced and signedcertified tester
What the AI actually does during an engagement
Broader reconnaissance
Mapping subdomains, endpoints, parameters and technologies, with automatic prioritisation of the most promising targets.
Continuous analysis
Reading responses, client-side JavaScript and error messages to catch clues a rushed human would miss.
Attack hypotheses
Specialised agents propose and test scenarios (access control, injection, logic) in a strictly non-destructive way.
Adversarial qualification
One agent tries to disprove every finding before it reaches the tester, removing most false positives.
Structured reporting
Evidence, reproduction steps, CVSS score and remediation drafted automatically, then reviewed by a human.
Human validation
Nothing ships until a CPTS, CAPE and CRTA certified tester has reproduced and confirmed it.
AI pentest vs vulnerability scanner vs manual pentest
| Criterion | Vulnerability scanner | Manual pentest | Hybrid AI pentest (HackHeart) |
|---|---|---|---|
| Business logic flaws | Not detected | Yes | Yes (AI lead, human validation) |
| Multi-step attack chains | No | Yes, time permitting | Yes, with more paths explored |
| False positives in report | Many | Few | Few (AI filter then human filter) |
| Surface coverage | Wide but shallow | Limited by time | Wide and deep |
| Executive-ready report | No | Yes | Yes |
Safeguards of a serious AI pentest
- Written authorisation and a signed scope before any action. Scope is enforced technically, not merely "asked" of the AI.
- No destructive testing: agents are restricted from denial of service, deletion or modification of production data.
- Data pseudonymisation: client IPs, URLs and identifiers are replaced by tokens before any processing by a language model. No identifying data leaves our infrastructure in clear, and this is verifiable: the engagement logs showing what was transmitted can be shared with you.
- Traceability: every agent action is logged and can be shared with the client.
- Accountability: a named tester signs the report; HackHeart holds professional liability insurance specific to penetration testing.
Who is it for?
SaaS vendors shipping frequently, SMEs and mid-size companies that must prove their security level to customers or insurers, professional firms handling sensitive data, and organisations in scope of NIS2 or DORA that must regularly assess the effectiveness of their security measures. HackHeart works across Europe remotely and on site in southern France and Monaco.
Read more
- Autonomous pentesting with AI agents: promise and limits
- AI pentest methodology in 8 steps
- FAQ: cost, duration, risk, compliance
- Agentic pentesting in 2026: market overview and evaluation checklist (in French, on hackheart.tech)
- Umbra: HackHeart's multi-agent architecture in detail (in French, on hackheart.tech)
- Version française : pentest IA