Update the client during the engagement if a finding is urgent, a window has to move, or testing must pause
An agent can draft a status note from the engagement log. The tester checks anything that changes risk, downtime or the agreed scope.
AI for Penetration Testers
Penetration Tester
Tests systems for security weaknesses by planning assessments, attempting controlled exploits, documenting findings, and recommending fixes to reduce risk.
What should stay human.
Keep and amplify
Agree the scope, the rules of engagement and what is out of bounds with the client before any testing starts
Plan the authorised assessment from the agreed scope, including windows, contacts and evidence handling
Carry out the authorised assessment within the agreed scope, and stop at the agreed limit
Automate
Collect the scope, architecture notes, contacts and written authorisation before work starts
Schedule testing windows, readout meetings and retest dates around the client's change calendar
Send an engagement letter, a scope document and the rules of engagement for signing
Tasks, by type of work.
Each task has an experience tag (CX, SX or BX), a verdict, and example agents that often help with this kind of work. Agent suggestions come from our editorial scores, not vendor claims.
Inbox
Collect the scope, architecture notes, contacts and written authorisation before work starts
Checklists and reminders can chase the standard pack, so an assessment does not start without a complete, signed authority.
Bookings & calendar
Schedule testing windows, readout meetings and retest dates around the client's change calendar
Finding times and sending reminders is a scheduling job, and it is easy to miss a window when several clients share the same week.
Spreadsheets & data
File evidence, signed authorities and issued reports against the engagement
Approved records can be filed automatically, which matters if a later question, a retest or an audit needs the original authorisation and findings.
Documents
Plan the authorised assessment from the agreed scope, including windows, contacts and evidence handling
An agent can draft a plan from a standard engagement template and the scope document. The tester confirms that the plan stays inside the authorisation and does not invent extra targets.
Write the findings report, with clear evidence, impact and practical remediation priorities
An agent can assemble notes, screenshots and a first draft from a standard report template. The tester confirms every finding and recommendation, because a client will use the report to change access, spend money or talk to their board. The report describes what was found and what to fix, not how to attack a system.
Example agents: Grok Bot, Claude, Microsoft Copilot
Send an engagement letter, a scope document and the rules of engagement for signing
Standard documents can be generated from the matter record and sent for signing before any testing starts.
Example agents: Grok Bot, Claude, Microsoft Copilot
Invoice the engagement from the agreed fee and any approved extras
Invoices can be generated from the confirmed scope and signed extras, so billing goes out with the report or the agreed milestone.
Research
Look up a vendor advisory or a public vulnerability note that relates to an already-identified finding
An agent can find and summarise official advisories quickly. Deciding whether the finding matters in this client's environment, and how urgently it should be fixed, stays with the tester. This is a lookup of published guidance, not a method for creating an exploit.
Example agents: Manus
Customer chat
Agree the scope, the rules of engagement and what is out of bounds with the client before any testing starts
This is a professional conversation about risk, authorisation and limits. An agent can help assemble a draft scope, but agreeing what may be tested, and when to stop, should stay with the tester. The work is only done with the client's written authorisation.
Talk the client through findings that will be unwelcome, expensive, or that need a prompt change
This needs judgement and a direct conversation, not a report left for them to read alone when a finding will be unwelcome or expensive.
Admin
Carry out the authorised assessment within the agreed scope, and stop at the agreed limit
Judgement about what is in scope, what to record, and when to pause or stop sits with the tester. An agent can help organise notes afterwards, but it should not run the assessment or suggest attack methods. This role is described at that level of detail only.
Time freed, and where it goes.
Work an agent can take on
What comes off the desk.
- Collect the scope, architecture notes, contacts and written authorisation before work starts
- Schedule testing windows, readout meetings and retest dates around the client's change calendar
- Send an engagement letter, a scope document and the rules of engagement for signing
- File evidence, signed authorities and issued reports against the engagement
- Invoice the engagement from the agreed fee and any approved extras
Where those hours should go
Back into people, and the business.
- CX —Agree the scope, the rules of engagement and what is out of bounds with the client before any testing starts
- CX —Update the client during the engagement if a finding is urgent, a window has to move, or testing must pause
- CX —Talk the client through findings that will be unwelcome, expensive, or that need a prompt change
- SX —Staff experience: more time for the work that needs a person
- BX —Plan the authorised assessment from the agreed scope, including windows, contacts and evidence handling
- BX —Carry out the authorised assessment within the agreed scope, and stop at the agreed limit
- BX —Write the findings report, with clear evidence, impact and practical remediation priorities
- BX —Look up a vendor advisory or a public vulnerability note that relates to an already-identified finding
Seen at
Business types where this role often appears, with a note on how it shows up there.
Want this set up for you?
If you would like someone to build these penetration tester flows in your business, tell us a little and we can match you with an agency. We don’t list agencies on this site.