Why AI in Pentesting Must Stand up to Independent Scrutiny

When you commission a penetration test, you’re trusting a provider with access to sensitive systems and information. You need confidence in how the testing is conducted, the findings your team will act on, and the people responsible for the work. As AI becomes part of that process, it deserves the same scrutiny as any other part of your provider’s methodology.

A statement that a provider “uses AI responsibly” is vague and intangible, but security leaders need to completely understand how that commitment carries through into an engagement, including how the technology is controlled and where professional judgment comes in.

This is why we put our approach through independent review, and we’re proud to announce being one of just ten providers named in CREST’s first cohort to achieve AI-Enabled Penetration Testing accreditation, which assesses the responsible, secure, and appropriate use of AI within pentesting services.

Learn more: Should Pentesters Report Out-of-Scope Findings?

‍

Independent assurance for how AI is used

CREST launched the accreditation in July 2026 to establish an independent benchmark for providers incorporating AI into pentesting. Its emphasis includes maintaining professional oversight and accountability as the technology becomes part of service delivery.

As CREST CEO Nick Benson put it, the industry needs to move “from discussion and principles towards independently assured, responsible adoption.” CREST’s announcement reflects a practical concern for buyers: they need evidence to evaluate how providers use AI.

That concern is familiar to anyone responsible for third-party risk, as introducing AI into a service raises questions about information handling, oversight, and responsibility for the output. A provider should be able to explain its approach clearly enough for a customer to assess it and an independent reviewer to examine it.

At Thoropass, our approach brings together the tools that govern AI use and the testers accountable for the engagement.

Learn more: Can AI replace pentesters? 

‍

Controls built into the testing workflow

Our pentesting team uses an internal plugin, pentest-os, alongside the software environment that manages how AI operates during testing. Together, these tools keep AI within defined guardrails that we can explain and audit.

Building those controls into the workflow helps make responsible use part of everyday delivery. The team needs a consistent way to direct the technology, understand its role in the work, and demonstrate how it’s being used.

For a customer, the underlying concern is straightforward: the introduction of AI should preserve control over the engagement. A capable model still needs to operate within a testing methodology that people understand and oversee. Its capabilities don’t remove the provider’s responsibility to document its approach or make that approach available for scrutiny.

Our tooling supports that discipline, and the people using it remain responsible for applying it.

‍

Experienced testers remain accountable

Using AI effectively requires testers to develop additional skills. They need to direct the technology, assess its output, and decide how that output should inform the next step in an engagement.

Our testers have taken on that responsibility while retaining ownership of every decision, finding, and report. AI contributes to the work under their direction, with professional judgment remaining central to the service.

That judgment is particularly important when a finding reaches your team. A pentest should help you understand an exposure and make an informed remediation decision. Your engineers need findings they can investigate and act on, while security leadership needs a clear view of the implications for the business.

The tester remains accountable for connecting the technical work to those needs. Adopting more capable tools makes careful review and clear ownership essential parts of the process.

‍

More evidence for your provider assessment

For security, risk, and procurement teams, the accreditation adds independent assurance to the evidence available when evaluating Thoropass. It gives you a reviewed basis for assessing our use of AI within pentesting.

Your organization will still have requirements specific to its systems, data, and risk tolerance. Those belong in the engagement discussion, alongside scope, methodology, and reporting expectations. The accreditation supports that conversation by establishing that our approach to AI has undergone external assessment.

We’re proud to be part of CREST’s first cohort. The work behind that recognition reflects how we believe AI should be adopted across security services: with documented controls, experienced people directing its use, and a willingness to have those practices examined.

Customers trust us to scrutinize their security. They should expect us to apply the same discipline to our own work.

‍