AI Can Write Exploits, But Can It Really Pen Test Your Organisation?
In our previous article we explored the trends our penetration testing team are seeing across customer environments in 2026. Since then, one question keeps coming up during customer conversations:
If AI can find vulnerabilities and write exploits, do we still need a penetration test?
With AI now capable of writing code, analysing vulnerabilities and automating research, it’s a fair question. But the reality is more nuanced.
One of the biggest misconceptions we encounter is that AI can replace a penetration tester because it can already identify vulnerabilities, write scripts and automate technical tasks.
In reality, AI is changing how penetration testing is performed – not why it’s performed.
The purpose of a penetration test has never been to simply produce a list of vulnerabilities. Organisations invest in penetration testing to understand how an attacker could compromise their environment, what that means for the business, and what should be prioritised to reduce real-world risk.
Just as automated vulnerability scanners transformed penetration testing two decades ago without replacing skilled testers, AI represents the next evolution of offensive security tooling. It makes penetration testers faster and more effective, but it doesn’t replace the expertise needed to uncover real-world cyber risk.
AI Is Changing How Penetration Testing Delivers Value
AI is already changing the way penetration tests are delivered – not by replacing testers, but by removing many of the repetitive tasks that previously consumed valuable time.
The biggest shift isn’t simply that penetration tests can be completed faster. It’s that security consultants can now spend more of an engagement analysing attack paths, validating risk and advising customers, rather than researching technologies or writing scripts from scratch.
Areas where AI is already improving efficiency include:
- Researching technologies, products and known vulnerabilities
- Explaining unfamiliar software, protocols and frameworks
- Generating PowerShell, Bash and Python scripts
- Analysing large volumes of vulnerability scan data
- Converting data into useful formats for reporting
- Summarising technical documentation
- Increasing overall productivity throughout an engagement
The result is a more valuable penetration test, with consultants spending less time on repetitive tasks and more time uncovering the security risks that matter most.
Finding Vulnerabilities Isn't The Hard Part Anymore
One trend we’ve noticed during customer engagements is that organisations are placing less value on simply identifying vulnerabilities and more value on understanding how those vulnerabilities could actually be exploited.
Understanding which of those vulnerabilities actually matter hasn’t become any easier.
Organisations don’t commission penetration tests because they want another list of CVEs or misconfigurations. They invest in penetration testing to answer much bigger questions:
- Could ransomware spread through our environment?
- Could an attacker compromise Active Directory?
- Could sensitive customer or business data be accessed?
Those answers require understanding attack paths, exploitability and organisational context – not simply identifying technical weaknesses.
In our experience, we’ve yet to complete a penetration test where AI has independently identified a complex attack path without a tester interpreting, validating and applying the wider business objectives.
That’s where experienced penetration testers continue to provide value.
Where AI Falls Short
While AI has transformed many aspects of offensive security, it still has significant limitations.
Large language models generate responses based on statistical prediction rather than genuine understanding. They don’t understand the organisation they’re assessing, its priorities or its wider business objectives.
Common limitations include:
- False positives
- Outdated information
- Missed vulnerabilities
- Limited understanding of business impact
In our experience, this is where the biggest difference between AI and an experienced consultant becomes apparent.
Human Expertise Remains the Most Important Element
Successful penetration testing depends on skills that extend well beyond technical knowledge.
Experienced testers continually adapt their approach based on discoveries made during an engagement. They recognise subtle attack paths, combine seemingly unrelated weaknesses and understand how technical findings translate into business risk.
These capabilities remain uniquely human.
Penetration testers provide value by:
- Thinking creatively when testing applications and infrastructure
- Adapting to unexpected findings during an assessment
- Chaining multiple low-risk vulnerabilities into realistic attack paths
- Understanding an organisation’s business context
- Explaining technical issues in language appropriate for different audiences
- Prioritising remediation based on operational impact rather than technical severity
The complete penetration testing lifecycle also continues to require human judgment:
Planning → Reconnaissance → Enumeration → Exploitation → Validation → Reporting
AI can assist throughout each stage, but it cannot independently manage the process or make informed security decisions.
Context Changes Everything
One of AI’s greatest weaknesses is its inability to fully understand organisational context.
A good example we often discuss with customers is an internal administration portal that doesn’t enforce Multi-Factor Authentication. An AI platform may immediately classify this as a high-severity vulnerability based solely on missing MFA.
An experienced penetration tester, however, evaluates additional factors such as:
- Whether the application is only accessible via VPN
- Network segmentation
- Use of privileged access workstations or jump servers
- Strong password and account lockout policies
- Existing monitoring and detection controls
- The likelihood of exploitation within the client’s environment
Only after considering the wider security architecture can an accurate risk rating be assigned.
Ironically, the environments where AI struggles most are often those with the most mature security controls. The more exceptions, bespoke applications and layered security an organisation has, the more important human judgement becomes.
Human Expertise Matters More Than Ever
One observation we’ve made over the past year is that AI isn’t replacing experienced penetration testers – it’s amplifying them.
The biggest productivity gains come when security consultants know exactly when to trust AI, and when not to.
Conversely, AI can also make inexperienced testers appear more capable than they really are. Generating scripts or technical explanations has become significantly easier. Knowing whether those outputs are accurate, relevant and safe to use still requires experience.
In many ways, AI has raised the importance of validation rather than reducing it.
Risks of Using AI During Penetration Testing
Like any technology, AI introduces its own risks.
Without appropriate governance, organisations may inadvertently reduce testing quality or expose sensitive information.
Common concerns include:
- Incorrect or outdated technical advice
- AI hallucinations resulting in false positives
- Limited awareness of newly disclosed vulnerabilities or zero-days
- Confidential client information being submitted to public AI platforms
- Junior testers accepting AI responses without verification
- Use of unapproved AI services that do not meet organisational security requirements
The greatest risk isn’t organisations using AI – it’s organisations assuming AI has already done the thinking.
For these reasons, AI should always operate within clearly defined governance and security policies, with all outputs reviewed by experienced penetration testers.
The Future of AI in Penetration Testing
From our conversations with customers and partners, there’s a growing narrative that AI will eventually automate penetration testing. We don’t think that’s where the industry is heading.
Instead, we see AI becoming deeply embedded within professional penetration testing, automating repetitive activities while allowing consultants to spend more time delivering the insight customers actually value.
Future developments are likely to include:
- Greater automation of repetitive testing activities
- Faster generation of penetration testing reports
- Improved assistance with secure code review and analysis
- Better integration with infrastructure, cloud and application scanning tools
- Enhanced support during external, internal, cloud and application security assessments
- Recommendations for alternative testing strategies based on findings
As these technologies mature, AI will become an increasingly valuable assistant throughout the assessment lifecycle.
However, human oversight will remain essential.
Final Thoughts
Artificial Intelligence is changing how penetration testers work, but it is not replacing them.
Its greatest value lies in increasing efficiency, reducing repetitive tasks and allowing experienced professionals to spend more time analysing complex security problems.
The organisations that gain the greatest benefit from AI will view it as an enhancement to skilled penetration testers, not a substitute for them.
This evolution mirrors the transformation that occurred over the past twenty years.
Many activities that were once performed manually are now automated using tools such as Nmap, Burp Suite and Nessus. These technologies dramatically improved productivity but did not eliminate the need for penetration testers.
AI represents the next stage in that evolution.
The future of penetration testing isn’t human expertise or AI alone. It’s the combination of skilled professionals and AI-assisted tooling, working together to deliver faster, deeper and more meaningful security assessments.
AI can generate exploits, but it still can’t explain to your board why a seemingly minor technical weakness represents a significant business risk.
That’s where experienced penetration testers continue to add the greatest value.
Whether you’re reviewing your current penetration testing approach or planning your next assessment, choosing the right expertise has never been more important.
Find out how MTI’s CREST and The Cyber Scheme-accredited penetration testing team helps organisations uncover, understand and reduce real-world cyber risk.
About The Author
Jack Duffy is Senior IT Security Consultant in Penetration Testing at MTI Technology, helping organisations strengthen their security posture through expert penetration testing and infrastructure security assessments. With more than 12 years at MTI, he is a CHECK Team Leader specialising in infrastructure testing and holds the Principal Cyber Security Professional qualification with the UK Cyber Security Council.
Drawing on extensive experience delivering security assessments across a wide range of environments, Jack provides organisations with practical, risk-focused guidance to identify vulnerabilities, improve resilience, and support secure digital transformation. His hands-on expertise and deep technical knowledge enable businesses to address evolving cyber threats with confidence.