AI Forces Organizations To A Higher Security Testing Maturity
Rohit Dhamankar, VP, M&A and AI Strategy at Fortra, with 15+ years of cybersecurity experience.
gettyFor years, security teams operated on the assumption that once a vulnerability is disclosed, there is a considerable window of days or even weeks before anyone weaponizes it.
That assumption no longer holds. The gap between a vulnerability becoming public and it being exploited is now measured in minutes. Attackers didn’t suddenly get smarter. They gained access to the same AI tools everyone else did, and that access has democratized knowledge that used to take years of specialized training to acquire. The skill that once separated a script kiddie from a serious threat actor is thinning out.
However, many organizations are still operating on an older cadence: two penetration tests (pentests) a year to satisfy a compliance auditor and a defenses-first mindset that celebrated shaving a few days off critical patch time as a real win. Red teaming and penetration testing talent was expensive and rare enough.
Does that mean we no longer need great red teamers and penetration testers? Absolutely not. AI is exceptionally good at finding every known class of vulnerability and combining them in ways no human team could test for manually. But attack surfaces keep evolving, and finding an entirely new class of bug still requires the nonlinear leap and ingenuity only a person can muster.
None of this is conceptually new. Chaining low-severity issues into something far more dangerous is a technique ransomware operators were using years before generative AI existed. Attackers were always stitching together remote vulnerabilities with privilege-escalation bugs that individually looked harmless.
AI has changed scale and speed. It can search for and assemble those attack chains automatically across far more surface area than a human team ever could, and it can do it continuously.
That scale change matters because most organizations still think about vulnerabilities one at a time. A single low-severity finding gets triaged, deprioritized and forgotten. AI doesn’t work that way. Two issues that were each an acceptable risk on their own can become a serious breach path once something automated is patient enough to test every permutation.
CISA and the FBI issued a joint advisory describing exactly this attack pattern against Ivanti Cloud Service Appliances. Attackers first exploited an admin authentication bypass to gain access, then used a separate SQL injection flaw to steal credentials and finally leveraged two additional issues to achieve remote code execution and plant a persistent web shell. Four moderate findings, each one manageable on its own, were sequenced into a full network compromise.
Not every organization is exposed to this change in the same way, and treating the response to this challenge as one-size-fits-all is a mistake.
Companies that don’t build software still have plenty of exposure, but their priority is visibility. Knowing exactly what software assets are running across the environment and having a patching process fast enough to close gaps before they’re found matters more than anything else.
Companies writing application-level code face a different problem. Pentesting used to sit near the end of a security maturity curve; something you got to once the rest of the program was in decent shape. That ordering is being reversed. These vendors should expect an initial “barrage” of AI-discovered vulnerabilities the first time a pentesting tool is employed, and the real work becomes prioritization.
The same AI coding tools driving efficiency gains are also introducing more bugs into the codebase. Speed without internal quality control is not a neutral trade.
Then there are the platform-scale vendors already living in this reality. A significant share of the vulnerabilities disclosed in a given patch cycle from any major vendor today are found by AI rather than a human researcher. That has a ripple effect. Every organization consuming that software now has to assess and patch faster and check whether a newly disclosed vulnerability chains with something already sitting in its own stack.
Bug bounty programs built their reputation on the scarcity of ingenuity. What started as roughly a $10,000 top payout for early vulnerability research programs has, in the years since, climbed beyond quarter-million-dollar territory for breaking into something like a modern connected vehicle. That kind of money exists because that kind of skill is rare.
What AI has removed is the busywork around it. Give a model a known technique class, and it will exhaustively find every variation across a codebase faster than any human team could. But it cannot originate a technique. A genuinely new attack vector still comes from a human finding something the training data has never seen. AI can master and scale this new discovery. The discovery itself still takes a human.
The change worth naming is where expert time goes: less on exhaustive coverage, more on the one thing that still can’t be automated—finding what nobody else has found yet.
This is exactly why red teaming can no longer be treated as optional. The industry’s compliance standards have already made this argument for us. Security testing has to follow the same logic. If attackers are running AI-assisted discovery against your environment continuously, the only credible counter is running that same kind of adversarial testing against yourself continuously, rather than once a year ahead of an audit.
An organization without a red team program in place today is not just behind on a testing maturity curve. It doesn’t know what an attacker with these tools already knows about its own environment.
For a team starting from nothing, the first move is a scoped engagement focused on the assets that would hurt the most if compromised, paired with a leadership commitment to make that testing recurring rather than a one-time exercise.
Preemptive testing can no longer be a late-stage checkbox. It has to run constantly, calibrated to the type of AI in play and how mature that program already is.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
