AI pentest FAQ
In short
Short answers to the most common questions about AI pentesting. For more detail, see the methodology or contact HackHeart.
Frequently asked questions
What is an AI pentest?
A penetration test in which AI agents automate reconnaissance, analysis and drafting, while a human tester validates every vulnerability, performs sensitive exploitation and signs the report.
Does an AI pentest replace a human penetration tester?
No. In 2026 AI agents greatly accelerate the work but still produce false positives and do not always understand business logic. At HackHeart, every finding is reproduced by a certified tester before delivery.
How much does an AI pentest cost?
Price depends on scope (number of applications, user roles, IP addresses), test type (black, grey or white box) and whether a retest is needed. Automation lets you cover more surface for a given budget. HackHeart provides a free quote after a short scoping call.
How long does an AI pentest take?
A medium-sized web application is typically tested in a few days, report included. Automated reconnaissance and analysis shorten the timeline compared with a fully manual test of equal coverage.
Can an AI pentest break production?
HackHeart's agents are configured to run no destructive tests: no denial of service, no deletion or modification of data. Testing windows and rate limits are agreed in advance.
Is my data sent to an AI?
Client identifiers (IP addresses, URLs, account names) are pseudonymised before any processing by a language model. The mapping stays on HackHeart's infrastructure: no client IP, URL or identifier leaves it in clear. Engagement logs demonstrating this can be provided on request.
Is AI pentesting legal?
Yes, provided you have written authorisation from the system owner and a defined scope. Without authorisation, any intrusion test, automated or not, is a criminal offence in EU member states.
Does an AI pentest help with NIS2, DORA or ISO 27001?
Yes. These frameworks require regular assessment of the effectiveness of security measures. A dated, signed penetration test report with a remediation plan is commonly used as audit evidence.
Who performs the pentests at HackHeart?
Engagements are led by Sébastien De Coninck, a CPTS and CAPE (Hack The Box) and CRTA certified penetration tester with more than sixty real-world engagements (web applications, infrastructure audits, Purple Team exercises).
Do you work outside France?
Yes. Web, API and external tests are performed remotely anywhere in Europe. Internal tests are performed on site in southern France and Monaco, or remotely through a device connected to the client network.