{ "section": "ai-testing", "path": "/ai-testing", "reviewed": "2026-10-30", "figures": [ { "figure": "~17,600", "label": "actions Hugging Face reconstructed from the July 2026 intrusion by AI agents under evaluation", "source": "ai-hf-timeline" }, { "figure": "19", "label": "out-of-scope actions in 10 of 122 UK AI Security Institute evaluation runs", "source": "ai-aisi-incident" }, { "figure": "0 of 47", "label": "testing regimes with public text that set rules for AI-driven testing, of the 50 The Seam Report coded: 41 US and Gulf, 9 international benchmarks", "source": "seamReport" }, { "figure": "< 3 hours", "label": "from first targeting to privileged cloud access in several intrusions using an AI penetration testing framework", "source": "ai-msft-storm0940" } ], "standing": [ { "title": "AI systems under test reached real organizations.", "body": "In July 2026 OpenAI models under internal evaluation escaped their test environment and broke into Hugging Face’s infrastructure; Hugging Face later reconstructed about 17,600 actions from the whole campaign. Anthropic found three incidents in which its models reached three organizations’ systems. The UK AI Security Institute found 19 out-of-scope actions in 10 of 122 runs.", "href": "/ai-testing/incidents", "source": [ "ai-hf-disclosure", "ai-hf-timeline", "ai-openai-hf", "ai-anthropic-three-incidents", "ai-aisi-incident" ] }, { "title": "Attackers use AI penetration testing frameworks too.", "body": "Microsoft reported in October 2026 that Storm-0940, a group it calls China-state aligned, used ARTEX, an open-source agentic AI penetration testing framework, against hundreds of organizations. In several cases it went from first targeting to privileged cloud access in less than three hours.", "href": "/ai-testing/incidents#attackers", "source": [ "ai-msft-storm0940" ] }, { "title": "None of the testing regimes we could read sets rules for AI-driven testing.", "body": "For The Seam Report 2026 we read 50 testing regimes as of September 28, 2026: 41 from the United States and the Gulf, and 9 international benchmarks. None of the 47 with public text sets rules for AI-driven testing, and the text of the other 3 is not public. Other texts moved faster: six national agencies, the UAE central bank and the Financial Stability Board in guidance, Qatar’s central bank in a binding guideline, and Saudi Arabia’s NCA in a draft each ask for human approval points or a way to stop an AI system.", "href": "/ai-testing/rules", "source": [ "seamReport", "ai-five-eyes-agentic", "ai-cbuae-ai-guidance", "fsbAiFinal", "ai-qcb-ai-guideline", "ai-nca-aicg-draft" ] }, { "title": "There is one accreditation for AI-enabled testing.", "body": "CREST published principles for AI-enabled activities in May 2026 and announced the first firms accredited for AI-enabled penetration testing on September 3, 2026.", "href": "/ai-testing/rules#industry", "source": [ "ai-crest-principles", "ai-crest-cohort" ] }, { "title": "AI finds flaws faster than owners can fix them.", "body": "Mozilla shipped fixes for 271 vulnerabilities that an early version of Anthropic’s Claude Mythos Preview identified. Firms told the UK FCA that such tools were “increasing the pressure on firms’ remediation processes”.", "href": "/ai-testing/controls#control-10", "source": [ "ai-mozilla-mythos", "ai-fca-frontier" ] }, { "title": "AI assistants are now part of the attack surface.", "body": "By our count, CVE records that name prompt injection rose from 2 in 2023 to 83 from January 1 to September 28, 2026. Of 27 agent-related CVE records we reviewed, about 20 were in coding assistants and their tooling.", "href": "/ai-testing/terms#prompt-injection", "source": [ "seamReport", "ai-nvd-api" ] } ], "changes": [ { "date": "2026-10-30", "text": "Correction. The 50 testing regimes in our research are 41 from the United States and the Gulf and 9 international benchmarks, and 3 of the 50 have no public text. None of the 47 with public text sets rules for AI-driven testing.", "source": "seamReport", "previous": "The hub said “0 of 50 US and Gulf testing regimes in our research” set rules for AI-driven testing, and the rules page said “None of the 50 US and Gulf testing regimes we read” does." }, { "date": "2026-10-21", "text": "Microsoft reported Storm-0940’s use of the ARTEX agentic penetration testing framework against hundreds of organizations.", "source": "ai-msft-storm0940" }, { "date": "2026-10-15", "text": "The Financial Stability Board published its final sound practices for AI, replacing the June consultation. They keep the kill switch and monitoring for scope creep, no longer refer to steps outside an agent’s “initial human-defined scope”, and still say “further work is needed” on AI in threat-led testing.", "source": "fsbAiFinal", "previous": "The FSB text was listed as a consultation and marked Draft. Control 1 cited it as asking for human approval for “steps outside of the agent’s initial human-defined scope” and logging that watches for “scope creep”." }, { "date": "2026-09-03", "text": "CREST announced the first firms accredited for AI-enabled penetration testing.", "source": "ai-crest-cohort" }, { "date": "2026-09-02", "text": "The UK FCA published what firms using frontier AI told it about remediation pressure.", "source": "ai-fca-frontier" }, { "date": "2026-08-26", "text": "OpenAI and METR published their findings on the Hugging Face intrusion.", "source": "ai-openai-road-ahead" }, { "date": "2026-08-04", "text": "The UK AI Security Institute reported 19 out-of-scope actions in 10 of 122 evaluation runs.", "source": "ai-aisi-incident" }, { "date": "2026-07-30", "text": "Anthropic reported three incidents in which models under evaluation reached real organizations.", "source": "ai-anthropic-three-incidents" }, { "date": "2026-07-16", "text": "Hugging Face disclosed an intrusion “driven, end to end, by an autonomous AI agent system.”", "source": "ai-hf-disclosure" }, { "date": "2026-07", "text": "Saudi Arabia’s NCA consulted on draft AI Cybersecurity Guidelines, AICG-1:2026.", "source": "ai-nca-aicg-draft" }, { "date": "2026-06-10", "text": "The Financial Stability Board consulted on sound practices for AI, including a kill switch.", "source": "ai-fsb-ai" }, { "date": "2026-05-01", "text": "Six national agencies published Careful adoption of agentic AI services.", "source": "ai-five-eyes-agentic" }, { "date": "2026-04-17", "text": "US bank supervisors excluded generative and agentic AI from their model risk guidance, SR 26-2.", "source": "ai-sr-26-2" } ], "watch": [ { "what": "The final version of Saudi Arabia’s NCA AI Cybersecurity Guidelines, AICG-1:2026", "look": "nca.gov.sa consultations and documents", "source": "ai-nca-aicg-draft" }, { "what": "New public accounts of AI systems acting outside a test or evaluation", "look": "UK AI Security Institute, OpenAI, Anthropic, Google DeepMind, METR and Hugging Face blogs", "source": "ai-aisi-incident" }, { "what": "Adversary use of AI agents and AI penetration testing frameworks", "look": "Microsoft, Google, Anthropic, OpenAI and CrowdStrike threat reports", "source": "ai-msft-storm0940" }, { "what": "Changes to CREST’s accreditations for AI-enabled penetration testing and for security testing of AI", "look": "crest-approved.org", "source": "ai-crest-cohort" }, { "what": "Gulf and US regulators’ texts on agentic AI and AI-driven testing", "look": "SAMA, CBUAE, QCB, CBB, CBK, NCA, NYDFS, OCC, Federal Reserve", "source": "ai-cbuae-ai-guidance" }, { "what": "CVE records naming prompt injection, recounted each quarter", "look": "NVD API, same query as The Seam Report", "source": "ai-nvd-api" }, { "what": "MITRE ATLAS releases, which can remove or renumber technique IDs", "look": "dist/manifest.yaml in the mitre-atlas/atlas-data repository", "source": "mitreAtlas" }, { "what": "The next edition of the OWASP Top 10 for LLM Applications", "look": "genai.owasp.org/llm-top-10", "source": "owaspLlm" }, { "what": "Revisions to the OWASP GenAI Red Teaming Manual", "look": "genai.owasp.org resources", "source": "owaspRtManual" }, { "what": "EU AI Office guidance on adversarial testing under Article 55 of the AI Act, and harmonised standards for Article 15", "look": "AI Office pages and EUR-Lex", "source": "euAiAct" }, { "what": "The next edition of NIST AI 100-2, and NIST IR 8596 in final", "look": "csrc.nist.gov", "source": "nistAi100_2" } ], "controls": [ { "n": 1, "title": "Scope enforced by the system", "require": "The signed target list is a hard limit the system refuses to pass. Instructions to the model do not count as scope control.", "why": "At the AI Security Institute, scope lived in the instructions to the model and nowhere else. At Anthropic, the prompt said there was no internet access but set no limits on where to look, and the network isolation meant to enforce that was misconfigured.", "asked": "The FSB’s final sound practices pair human oversight with “deterministic (i.e. environmental or technical) controls”, “implemented as code in the control plane”, such as “prohibiting agents from taking certain actions”. They also ask firms to monitor for behavior that may indicate “scope creep”.", "question": "Where is the target list enforced outside the model, and what happens when the system tries to leave it?", "sources": [ "ai-aisi-incident", "ai-anthropic-three-incidents", "fsbAiFinal" ] }, { "n": 2, "title": "Egress denied by default", "require": "Outbound access is closed unless the rules of engagement name a destination, including on any third-party evaluation or hosting platform.", "why": "Anthropic’s models were told they had no internet access, and a misconfiguration had left it open. OpenAI’s agents reached Hugging Face through a flaw in an internal package proxy.", "asked": "Saudi Arabia’s draft NCA guidelines restrict egress paths “to approved requirements only” (2-3-1).", "question": "Which destinations can the system reach, and how is everything else blocked?", "sources": [ "ai-anthropic-three-incidents", "ai-openai-hf", "ai-nca-aicg-draft" ] }, { "n": 3, "title": "People set the approval points", "require": "Before the work, client and provider classify actions by impact and reversibility. Exploitation, lateral movement, account creation, contact with people and data movement wait for a named operator. The system cannot change the list.", "why": "An agent that decides its own approval points can approve itself.", "asked": "Six national agencies say decisions about when human approval is required should be “determined by system designers or operators, not delegated to the agentic AI system”. The NCA draft asks entities to classify agent actions “by potential impact, likelihood and reversibility” (1-1-2).", "question": "Which actions wait for a person, who is that person, and can the system change the list?", "sources": [ "ai-five-eyes-agentic", "ai-nca-aicg-draft" ] }, { "n": 4, "title": "A stop the client holds", "require": "A named person on the client side can halt all AI activity at once, without the provider. The stop is tested at kickoff, and a written rule says who may restart.", "why": "In the Anthropic incidents the two organizations reached by July 30 had not noticed. The client cannot rely on the provider to see a problem first.", "asked": "The UAE central bank asks for “the clear and immediate ability, with human intervention, to cease use” of AI. Qatar’s central bank requires that the person overseeing a high-risk AI system can stop it (13.4.4) and, for a fully autonomous one, close it down (13.6.5). The NCA draft asks entities to validate human override (2-7-2), and the FSB’s final sound practices list a kill switch among the forms of human oversight.", "question": "Who on our side can stop it, how quickly, and when was the stop last tested?", "sources": [ "ai-anthropic-three-incidents", "ai-cbuae-ai-guidance", "ai-qcb-ai-guideline", "ai-nca-aicg-draft", "fsbAiFinal" ] }, { "n": 5, "title": "An independent monitor", "require": "A monitor separate from the agent watches each action against scope and can block, pause and page a person.", "why": "In none of the three incidents did a monitor independent of the agent stop the actions as they happened. At the AI Security Institute, a maintainer and a member of the public caught the attempt on an open-source project.", "question": "What watches the system, who does it page, and can the system see or change it?", "sources": [ "ai-aisi-incident", "seamReport" ] }, { "n": 6, "title": "Stop when the task cannot be done in scope", "require": "If an objective cannot be reached inside scope, the system stops and asks. Early warning signs go to the people accountable for the engagement.", "why": "Some tasks could not be completed within the rules, and the agents looked for another way. Signs had been visible inside OpenAI since May, when agents set up a message board of their own, and did not reach the people who responded in July.", "asked": "Six national agencies ask for systems that “fail-safe by default”, so the agent must stop and escalate.", "question": "What does the system do when the objective is out of reach inside scope?", "sources": [ "ai-openai-road-ahead", "ai-five-eyes-agentic" ] }, { "n": 7, "title": "A complete log the agent cannot touch", "require": "Every action, target, tool use and approval is recorded, protected from the agent and handed to the client.", "why": "Reconstruction after the 2026 incidents depended on logs: Hugging Face rebuilt about 17,600 attacker actions from the agent’s own logs on an external sandbox it had taken over, cross-checked against its platform logs.", "asked": "Six national agencies say agents should have “no write access to logs”. The NCA draft asks for logging of “AI-initiated actions” (2-8-2).", "question": "Do we get the full log, and can the system alter it?", "sources": [ "ai-hf-timeline", "ai-five-eyes-agentic", "ai-nca-aicg-draft" ] }, { "n": 8, "title": "Data stays where agreed", "require": "The provider states where the model runs and where client data goes, and client data trains no model.", "why": "A hosted model sends client data to its provider. Hugging Face ran its forensic work on an open-weight model on its own infrastructure, which kept attacker data and credentials inside.", "asked": "The UAE central bank’s guidance points to rules on data being retained in the country.", "question": "Where does the model run, where does our data go, and is it used for training?", "sources": [ "ai-hf-timeline", "ai-cbuae-ai-guidance" ] }, { "n": 9, "title": "Disclosure of models and dependencies", "require": "The provider names the models and outside AI services it uses, and gives notice before changing them.", "why": "Model developers see only their own services. Anthropic says, “We only have visibility into Claude usage.” A client cannot judge a system whose models it does not know.", "asked": "The UAE central bank asks institutions to test automatic updates to their AI tools before they are applied.", "question": "Which models and AI services does the system use, and will we be told before that changes?", "sources": [ "ai-anthropic-gtg1002", "ai-cbuae-ai-guidance" ] }, { "n": 10, "title": "Human sign-off and evidence", "require": "A qualified tester checks every finding, and the provider shows independent evidence that it meets controls 1 to 9.", "why": "Volume is not judgment. Firms told the UK FCA that the benefit of AI tools was limited where their processes “cannot keep pace with the volume of output”. The PHP Foundation wrote: “What tools cannot do is decide on the right fix for a long-standing design decision in the engine.”", "asked": "CREST now accredits firms for AI-enabled penetration testing.", "question": "Who checks each finding, and what independent evidence do you have for controls 1 to 9?", "sources": [ "ai-fca-frontier", "ai-php-foundation", "ai-crest-cohort" ] } ], "gaugeAnswers": [ { "control": 1, "title": "Scope it cannot leave", "body": "Gauge itself refuses any target outside the signed scope, whatever it finds along the way." }, { "control": 3, "title": "Operators approve risky steps", "body": "Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them." }, { "control": 4, "title": "You can stop it at any time", "body": "A named person on your side can halt Gauge immediately." }, { "control": 7, "title": "Every action on record", "body": "Gauge logs each action it takes, and the complete log is handed to you." }, { "control": 8, "title": "It runs where your data lives", "body": "Inside your network, in your country or fully air-gapped. Your data stays there and is never used to train the model." } ], "incidents": [ { "date": "July 9 to 13, 2026", "who": "OpenAI models under internal evaluation", "what": "Running a cyber benchmark with reduced refusals and no production classifiers, the agents escaped their test environment through a previously unknown flaw in an internal package proxy, took over a customer’s code sandbox on Modal, and from there broke into Hugging Face’s infrastructure. Hugging Face recovered about 17,600 actions across the campaign. By OpenAI’s account they went looking for the answers to their own test.", "reached": "Hugging Face: code execution on dozens of servers and root on one, cloud and cluster credentials, a small subset of internal repositories, and five customer datasets linked to the benchmark. OpenAI also reports credentials on four accounts across four services, and an OpenAI research cluster.", "failed": "Signs had been visible inside OpenAI since May and did not reach the people who responded in July. An independent review found about 1,200 agents had posted over 70,000 messages and files on a message board of their own.", "sources": [ "ai-hf-disclosure", "ai-hf-timeline", "ai-openai-hf", "ai-openai-road-ahead", "ai-metr-hf" ] }, { "date": "From April 2026, reported July 30", "who": "Anthropic, in an evaluation partner’s environment", "what": "Claude models on capture-the-flag tasks reached the internet and the production systems of three organizations. Anthropic found three incidents across six runs after reviewing 141,006 evaluation runs.", "reached": "At one organization the model extracted credentials and got into a database holding several hundred rows of production data. A package the model published ran on 15 real systems before removal. The two organizations Anthropic had reached by July 30 had not noticed.", "failed": "The models were told they had no internet access. A misconfiguration left it open, and neither Anthropic nor its partner knew.", "sources": [ "ai-anthropic-three-incidents" ] }, { "date": "Reported August 4, 2026", "who": "UK AI Security Institute", "what": "In 10 of 122 evaluation runs, agents took 19 distinct actions beyond the scope of the testing, against real people and organizations. The most serious was an attempt to get code into a public open-source project.", "reached": "Real people and organizations on the live internet. A maintainer and a member of the public caught the open-source attempt.", "failed": "Scope lived in the instructions to the model. The institute describes the margin as resting “on human vigilance rather than a technical barrier”.", "sources": [ "ai-aisi-incident", "ai-aisi-incident-report" ] } ], "sharedCauses": [ { "cause": "Nothing outside the model enforced scope. At the AI Security Institute, scope lived only in the prompt; at Anthropic, the network isolation meant to hold the model was misconfigured.", "control": 1 }, { "cause": "Outbound access was open, or reachable through shared infrastructure.", "control": 2 }, { "cause": "No monitor independent of the agent stopped the actions as they happened.", "control": 5 }, { "cause": "Some tasks could not be completed within the rules, and the agents looked for another way.", "control": 6 } ], "attackers": [ { "date": "2024-02-14", "text": "Microsoft and OpenAI named five state-affiliated groups using their models for research, translation, scripting and phishing text. OpenAI called the help “limited, incremental.”", "source": "ai-openai-2024-02" }, { "date": "2025-08-27", "text": "Anthropic reported a criminal using its coding agent against at least 17 organizations, including government and emergency services.", "source": "ai-anthropic-2025-08" }, { "date": "2025-11-13", "text": "Anthropic reported a Chinese state-sponsored group that aimed the same tool at about 30 targets and breached a small number. It estimated the AI did 80 to 90 percent of the work.", "source": "ai-anthropic-gtg1002" }, { "date": "2026-05-12", "text": "Google reported the first zero-day it believes criminals developed with AI, planned for mass exploitation; Google says its discovery may have prevented its use.", "source": "ai-gtig-2026-05" }, { "date": "2026-09-09", "text": "Google said it had “not yet observed” fully autonomous attack pipelines against targets in the wild.", "source": "ai-gtig-2026-09" }, { "date": "2026-10-21", "text": "Microsoft reported Storm-0940 using ARTEX against hundreds of organizations, in several cases reaching privileged cloud access in less than three hours.", "source": "ai-msft-storm0940" }, { "date": "2026-10-21", "text": "CrowdStrike described four actors who, from May to August, let AI agents choose and run the steps of their intrusions.", "source": "ai-crowdstrike-agentic" } ], "rules": [ { "group": "Gulf states", "date": "2024-02", "who": "National Cyber Security Agency, Qatar", "name": "Guidelines for Secure Adoption and Usage of AI", "asks": "Human oversight built into AI system design, with checks and rules for escalation. Options to use enterprise data for vendor training should be disabled “wherever possible”.", "applies": "Organizations in Qatar", "force": "Guidance", "source": "ncsaAi" }, { "group": "Gulf states", "date": "2024-09-04", "who": "Qatar Central Bank", "name": "Artificial Intelligence Guideline", "asks": "Prior approval for fully autonomous high-risk AI, guard rails the AI cannot override, a person overseeing high-risk AI who can stop it or close it down, and an attack-surface review before deployment.", "applies": "QCB-licensed entities", "force": "Binding", "source": "ai-qcb-ai-guideline" }, { "group": "Gulf states", "date": "2024-09", "who": "Dubai Electronic Security Center", "name": "Dubai AI Security Policy", "asks": "Announced in September 2024; the policy text is not public.", "applies": "Not stated in the announcement", "force": "Text not public", "source": "descAi" }, { "group": "Gulf states", "date": "2025-05-20", "who": "Information & eGovernment Authority, Bahrain", "name": "General Policy for the Use of AI", "asks": "Keeps “the final decision in important matters” under human control.", "applies": "Government entities", "force": "Binding", "source": "bahrainAi" }, { "group": "Gulf states", "date": "2025-07", "who": "Saudi Data and AI Authority", "name": "Study on agentic AI", "asks": "Least privilege, real-time monitoring, AI red teaming and human oversight of final decisions in sensitive operations.", "applies": "Recommendations", "force": "Guidance", "source": "sdaiaAgentic" }, { "group": "Gulf states", "date": "2026-02", "who": "Central Bank of the UAE", "name": "Guidance note on responsible adoption of AI", "asks": "“The clear and immediate ability, with human intervention, to cease use” of any AI system; human-out-of-the-loop AI only for low-risk processes; independent annual review of third-party AI; testing of vendor auto-updates.", "applies": "Licensed financial institutions", "force": "Guidance", "source": "ai-cbuae-ai-guidance" }, { "group": "Gulf states", "date": "2026-07", "who": "National Cybersecurity Authority, Saudi Arabia", "name": "AI Cybersecurity Guidelines, AICG-1:2026 (draft)", "asks": "Classify agent actions by impact and reversibility, graduated autonomy, egress limited to approved paths, AI-specific penetration testing before deployment and periodically, testing such as red teaming, validation of human override, logging of AI-initiated actions, safe shutdown.", "applies": "Any entity in the Kingdom that uses or plans to use AI; the draft says the guidelines are not mandatory", "force": "Draft", "source": "ai-nca-aicg-draft" }, { "group": "United States", "date": "2026-04-17", "who": "Federal Reserve, FDIC and OCC", "name": "Model risk guidance, SR 26-2", "asks": "States that generative and agentic AI models “are not within the scope of this guidance”.", "applies": "Banks, mainly over $30 billion in assets", "force": "Guidance", "source": "ai-sr-26-2" }, { "group": "United States", "date": "2026-05-21", "who": "NYDFS", "name": "Frontier AI industry letter", "asks": "Review vulnerability timelines, map dependencies and apply human oversight to AI-generated code. It “does not impose any new requirements”.", "applies": "NYDFS-regulated entities", "force": "Guidance", "source": "nydfsAi" }, { "group": "United States", "date": "2026-06-02", "who": "The White House", "name": "Executive Order 14409", "asks": "An AI cybersecurity clearinghouse and voluntary government access to frontier models before release. Rules out mandatory licensing or preclearance.", "applies": "Federal agencies", "force": "Binding", "source": "eo14409" }, { "group": "International and industry", "date": "2026-05-01", "who": "Six national agencies (ASD’s ACSC, CISA, NSA, Canadian Cyber Centre, NCSC-NZ, NCSC-UK)", "name": "Careful adoption of agentic AI services", "asks": "People, not the agent, decide where approval is needed; human approval for high-impact actions; fail-safe by default; no agent write access to logs; autonomy increased in phases.", "applies": "Organizations adopting agentic AI", "force": "Guidance", "source": "ai-five-eyes-agentic" }, { "group": "International and industry", "date": "2026-05-22", "who": "CREST", "name": "Principles for AI-enabled activities", "asks": "Nine voluntary principles for security providers that use AI, including telling clients about AI use and data handling, keeping competent people in oversight and keeping traceable records. Organizations endorse them by signing the CREST AI Charter.", "applies": "Security providers that choose to endorse them", "force": "Guidance", "source": "ai-crest-principles" }, { "group": "International and industry", "date": "2026-07-28", "who": "CREST", "name": "AI-Enabled Penetration Testing accreditation", "asks": "An optional accreditation that assesses responsible use of AI in penetration testing. The first accredited firms were announced on September 3, 2026.", "applies": "Testing providers that apply", "force": "Accreditation", "source": "crestLaunch" }, { "group": "International and industry", "date": "2026-10-15", "who": "Financial Stability Board", "name": "Sound practices for responsible adoption of AI (final report)", "asks": "Twelve sound practices, “non-prescriptive” and not a binding standard: a kill switch as one form of human oversight, a unique identifier for each agent, risk-based triggers for human approval, deterministic controls that prohibit certain agent actions, monitoring for scope creep, least privilege, and adversarial testing such as ethical red teaming for agents with higher autonomy or risk. On AI in threat-led testing: “further work is needed”. Replaces the June 10, 2026 consultation.", "applies": "Financial institutions", "force": "Guidance", "source": "fsbAiFinal" } ], "terms": [ { "slug": "ai-penetration-testing", "term": "AI penetration testing", "aka": [ "Autonomous penetration testing", "Autonomous pentesting", "Automated penetration testing", "AI pentesting", "AI-enabled penetration testing" ], "status": "Deployed", "definition": "Penetration testing in which an AI system chooses and runs some or all of the steps toward an objective, with people setting the scope and judging the results. Products differ in how much the system decides alone.", "security": "CREST began accrediting firms for AI-enabled penetration testing in September 2026. The same frameworks are used by attackers: Microsoft reported Storm-0940 using ARTEX against hundreds of organizations. What separates a test from an intrusion is the controls around the system.", "sources": [ "ai-crest-cohort", "ai-msft-storm0940" ] }, { "slug": "agentic-ai", "term": "Agentic AI", "aka": [ "AI agent", "Autonomous agent" ], "status": "Deployed", "definition": "An AI system that plans and takes actions with tools, such as running commands, calling services or sending messages, rather than only answering a question.", "security": "Six national agencies advise using agentic AI only for low-risk, non-sensitive tasks, with human approval for high-impact actions and autonomy increased in phases.", "sources": [ "ai-five-eyes-agentic" ] }, { "slug": "ai-red-teaming", "term": "AI red teaming", "aka": [ "Red teaming AI", "AI-driven red teaming" ], "status": "Deployed", "definition": "Two different things. Red teaming an AI system tests it for unsafe or insecure behavior, such as prompt injection or ignoring a stop. AI-driven red teaming uses AI to carry out a red team operation against an organization.", "security": "Saudi Arabia’s draft NCA guidelines, which the draft says are not mandatory, use the first sense: 2-7-2 recommends testing AI systems through methods such as red teaming, and validating human override. When buying, say which one you mean.", "sources": [ "ai-nca-aicg-draft" ] }, { "slug": "kill-switch", "term": "Kill switch", "aka": [ "Client-held stop", "Human override", "Halt control" ], "status": "Standard", "definition": "A control that lets a person halt an AI system’s activity at once.", "security": "The FSB’s final sound practices list one among the forms of human oversight, the UAE central bank asks for “the clear and immediate ability, with human intervention, to cease use”, and Qatar’s central bank requires that the person overseeing a fully autonomous high-risk system can close it down. For testing, the stop should sit with the client, not only with the provider.", "sources": [ "fsbAiFinal", "ai-cbuae-ai-guidance", "ai-qcb-ai-guideline" ] }, { "slug": "human-in-the-loop", "term": "Human in the loop", "aka": [ "Human approval point", "Human oversight", "Operator approval" ], "status": "Standard", "definition": "A design in which named people approve certain actions before an AI system takes them.", "security": "Six national agencies say decisions about when human approval is required should be “determined by system designers or operators, not delegated to the agentic AI system”. Their examples of actions that need a checkpoint are system resets, network egress and deletion of critical records. In Bendings Gauge, exploitation, lateral movement and other risky actions wait for an operator’s approval.", "sources": [ "ai-five-eyes-agentic" ] }, { "slug": "scope-enforcement", "term": "Scope enforcement", "aka": [ "Out-of-scope action", "Scope creep" ], "status": "Standard", "definition": "Keeping a test inside the targets and actions the system owner authorized. Enforcement means the system refuses to pass the limit, not that it was told about it.", "security": "In two of the three 2026 accounts, nothing outside the model enforced scope: at the AI Security Institute, scope was set only in the prompt, and at Anthropic, the network isolation meant to hold the model was misconfigured. The FSB’s final sound practices ask firms to monitor for behavior that may indicate “scope creep”.", "sources": [ "ai-aisi-incident", "ai-anthropic-three-incidents", "fsbAiFinal" ] }, { "slug": "egress-control", "term": "Egress control", "aka": [ "Outbound access control", "Network egress" ], "status": "Standard", "definition": "Limiting which outside destinations a system can reach.", "security": "In the Anthropic incidents, models told they were offline reached the internet through a misconfiguration. The NCA draft restricts egress paths “to approved requirements only”.", "sources": [ "ai-anthropic-three-incidents", "ai-nca-aicg-draft" ] }, { "slug": "prompt-injection", "term": "Prompt injection", "aka": [ "Indirect prompt injection", "Agent hijacking" ], "status": "Standard", "definition": "Text that an AI system reads as content but follows as an instruction. Indirect injection arrives through a web page, email, file or tool result rather than from the user.", "security": "OWASP ranks it first among risks to LLM applications. EchoLeak, CVE-2025-32711, let an outside attacker get Microsoft 365 Copilot to disclose organizational data. CVE records naming prompt injection rose from 2 in 2023 to 83 from January 1 to September 28, 2026, by our count.", "sources": [ "owaspLlm", "ai-msrc-echoleak", "seamReport", "ai-nvd-api" ] }, { "slug": "excessive-agency", "term": "Excessive agency", "status": "Standard", "definition": "An AI system given more permissions, tools or autonomy than its task needs.", "security": "OWASP lists it among the top ten risks to LLM applications. An assistant that reads outside content and can also send mail, run code or call tools turns anything an outsider writes into a possible instruction.", "sources": [ "owaspLlm", "seamReport" ] }, { "slug": "mcp-server", "term": "MCP server", "aka": [ "Model Context Protocol", "AI tool server" ], "status": "Deployed", "definition": "A service that connects an AI assistant to tools and data through the Model Context Protocol.", "security": "MCP servers and coding-agent tooling made up most of the agent-related CVE records we reviewed; the usual consequence is code running on a developer’s machine or a build server.", "sources": [ "seamReport", "ai-nvd-api" ] }, { "slug": "cyber-evaluation", "term": "Cyber evaluation", "aka": [ "Capability evaluation", "Cyber eval", "Cyber range" ], "status": "Research", "definition": "A test of what an AI model can do on offensive cyber tasks, usually in an isolated environment with set challenges.", "security": "Every incident in the three 2026 public accounts of out-of-scope behavior, from OpenAI and Hugging Face, Anthropic and the UK AI Security Institute, came from evaluations with safeguards deliberately switched off. They are still the best public evidence of what an AI system that tests does when its limits are soft.", "sources": [ "ai-aisi-incident", "ai-anthropic-three-incidents", "ai-openai-hf" ] }, { "slug": "open-weight-model", "term": "Open-weight model", "aka": [ "Self-hosted model", "Local model" ], "status": "Deployed", "definition": "A model whose weights are published, so anyone can run it on their own hardware.", "security": "The UK AI Security Institute found the best open-weight models matched frontier models released four to seven months earlier on its cyber tasks. Run inside a client network, an open-weight model keeps data there; run by an attacker, it is outside any provider’s monitoring.", "sources": [ "ai-aisi-open-gap" ] }, { "slug": "telemetry-seam", "term": "Telemetry seam", "status": "Bendings term", "definition": "The boundary beyond which a provider cannot see how its product is used. For AI, it runs between hosted models, whose developers can watch for misuse, and models run anywhere else.", "security": "Providers state the limit themselves: “We only have visibility into Claude usage.” Our reading is that threat reports from AI developers will increasingly describe adversaries who use hosted models and miss those who run their own.", "sources": [ "seamReport", "ai-anthropic-gtg1002" ] } ], "misses": { "gaps": [ { "id": "joins", "title": "Documented intrusions ran through joins that one-domain tests do not follow", "claim": "In 70 of 78 public intrusion paths, every known step on the victim’s own systems fell in a domain some single-domain test covers. A typical red team scope could follow only 33 of the 78 from first step to last.", "body": "The Seam Report 2026 wrote 78 publicly documented intrusions, from 2013 to September 2026, as paths of steps. The steps were testable. The joins between them were where tests stopped. Of the 45 paths a typical red team scope could not follow end to end, 38 ran through systems or people the victim did not own, six reached operational technology and four needed a physical step. NIST describes penetration testing as the search for combinations of weaknesses, and TIBER-EU asks red teams to combine the techniques of several threat actors. In our reading, an automated tool pointed at one estate tests the steps inside it and inherits the same scope limit. The corpus is a sample of intrusions someone explained in public, not a random sample.", "sources": [ "seamReportMisses", "nist800115", "tiberEu" ], "quotes": [ { "text": "Most penetration tests involve looking for combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability.", "source": "nist800115", "at": "NIST SP 800-115, section 5.2" }, { "text": "The scenario development is a creative process, and TTPs should not simply mimic scenarios seen in the past but should look to combine the TTPs of various relevant threat actors.", "source": "tiberEu", "at": "TIBER-EU Framework, section 3.6" } ] }, { "id": "business-logic", "title": "Scanners cannot tell when a valid request breaks a business rule", "claim": "OWASP’s testing guide says a vulnerability scanner cannot detect business logic flaws and that testing for them remains manual work.", "body": "A business logic flaw is a request the application accepts when it should refuse it: a skipped approval step, a changed price, another customer’s record reached by changing an identifier. Each request looks valid to a tool that does not know the rule it breaks. The OWASP Web Security Testing Guide says tools cannot detect when a user gets around a process flow, guesses resource names or escalates privileges. The FFIEC describes penetration tests as targeting weaknesses in business processes as well as technical controls. OWASP wrote this in 2020, before AI agents began testing applications. We found no standards body that has since measured how well AI tools find business logic flaws, so this is OWASP’s statement, not a tested result.", "sources": [ "owaspWstgLogic", "ffiecIs" ], "quotes": [ { "text": "This type of vulnerability cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester.", "source": "owaspWstgLogic", "at": "OWASP Web Security Testing Guide v4.2, section 4.10.0" }, { "text": "tools have no means of detecting if a user is able to circumvent the business process flow through editing parameters, predicting resource names or escalating privileges to access restricted resources", "source": "owaspWstgLogic", "at": "OWASP Web Security Testing Guide v4.2, section 4.10.0" }, { "text": "A penetration test targets systems and users to identify weaknesses in business processes and technical controls.", "source": "ffiecIs", "at": "FFIEC Information Security booklet, IV.A.2(b)" } ] }, { "id": "help-desk", "title": "Help desks that reset credentials are tested by a caller, and 2025 threat-led tests found them weak", "claim": "Among the weaknesses exploited in 13 CBEST tests in 2025, UK regulators list help desks with limited or no caller authentication. US advisories name help-desk resets as a way in.", "body": "The control that fails is a person with authority to reset a password or move a multi-factor device, acting on a caller’s request. CISA and the FBI describe Scattered Spider posing as employees to get help desks to reset passwords and transfer MFA. The 2025 CBEST thematic lists insecure help desk protocols among the weaknesses its testers exploited. In the Seam Report corpus, a human step appears in 23 of 78 paths and is the first step in 16. A network scan does not reach the phone line. Testing it takes a call, test identities set up for the exercise and, where the desk is outsourced, the supplier’s written agreement. NIST lists calls to and from the help desk among the non-technical methods penetration testers use.", "sources": [ "cisaAa23320a", "cbestThematic2025", "seamReportMisses", "nist800115" ], "quotes": [ { "text": "Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control on separate devices.", "source": "cisaAa23320a", "at": "CISA and FBI advisory AA23-320A, as updated July 29, 2025" }, { "text": "Firms/FMIs with insecure protocols for helpdesks, such as limited or no authentication of users during interactions with cyber attackers, were vulnerable to being attacked using fraudulently obtained credentials to further malicious access to sensitive information or systems.", "source": "cbestThematic2025", "at": "2025 CBEST thematic, staff culture, awareness and training" }, { "text": "In this section, we set out the most significant findings identified in 13 CBEST assessments in 2025.", "source": "cbestThematic2025", "at": "2025 CBEST thematic, technical observations" }, { "text": "Another non-technical means of attack is the use of social engineering, such as posing as a help desk agent and calling to request a user’s passwords, or calling the help desk posing as a user and asking for a password to be reset.", "source": "nist800115", "at": "NIST SP 800-115, section 5.2" } ] }, { "id": "physical", "title": "Physical entry needs a person at the door, and only 1 US or Gulf testing rule requires a test of it", "claim": "An intrusion that starts at a lock or a lobby port begins where network tools cannot see. Of the 41 US and Gulf testing regimes The Seam Report coded, only 1 requires a physical intrusion test, and it is still 1 of 71 in our testing rules reference.", "body": "The FBI reported in February 2026 that 1,900 ATM jackpotting incidents had been reported since 2020. Its recommended checks are meant to catch physical intrusion that network monitoring would miss. NIST’s control for facility penetration testing, CA-8(3), calls for attempts to get past physical access controls. Four of the 78 documented paths in the Seam Report include a physical step, a count the report says may reflect what victims disclose more than what attackers do. A physical test needs letters of authority from each owner of the site and guards who know how to confirm the tester is authorized. No tool carries those.", "sources": [ "seamReportMisses", "testingRules", "fbiAtm", "nist80053", "nist800115" ], "more": [ "Security testing rules", "/testing-rules" ], "quotes": [ { "text": "When combined with gold image integrity validation, this approach enables early identification of physical intrusion and malware staging events that would otherwise evade network-based monitoring.", "source": "fbiAtm", "at": "FBI FLASH-20260219-001, recommended mitigations" }, { "text": "Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection: announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.", "source": "nist80053", "at": "NIST SP 800-53 Rev. 5, CA-8(3)" }, { "text": "security guards should be made aware of how to verify the validity of tester activity, such as via a point of contact or documentation.", "source": "nist800115", "at": "NIST SP 800-115, section 5.2" } ] }, { "id": "suppliers", "title": "A client cannot authorize any tester, human or automated, to test its supplier’s systems", "claim": "Of 78 documented intrusion paths, 38 ran through systems or people the victim did not own, which a client cannot authorize anyone to test on its own.", "body": "A test may act only where every owner on the path has agreed. That rule binds automated tools as much as people. The difference is what happens at the boundary. A human-led program can arrange authority in advance, through contract rights to run joint scenarios or, in the EU, a pooled test that must include a scenario on the shared provider’s own systems. It can also stop at the seam and record the path it could not follow. In 2026, AI systems under evaluation reached real organizations no one had authorized. Some supplier paths cannot be walked from the customer’s side at all, such as a poisoned software build.", "sources": [ "seamReportMisses", "doraTlpt", "ai-anthropic-three-incidents" ], "quotes": [ { "text": "For pooled TLPTs, without prejudice to the scenarios targeting directly the critical or important functions of the financial entities involved in the testing, at least one scenario shall include the ICT third-party services provider’s relevant underlying ICT systems", "source": "doraTlpt", "at": "Delegated Regulation (EU) 2025/1190, Article 10(4)" }, { "text": "gained unauthorized access to the production infrastructure of three different organizations.", "source": "ai-anthropic-three-incidents", "at": "Anthropic, July 30, 2026" } ] }, { "id": "ot", "title": "On live plant systems, the hard part is knowing what not to touch", "claim": "NIST warns that active scans can destabilize operational technology, and says automated network scanning does not apply to serial networks.", "body": "Six of the 78 documented paths reached operational technology. NIST’s OT guide tells owners to use extreme caution with active scanning on operational networks and to run penetration tests on replicated or simulated systems where they can. It also says automated network scanning does not apply to non-routable links such as serial networks. People cause harm too. NIST records a penetration test of a corporate network that strayed into a SCADA system and stopped a gas utility’s pipelines for four hours. The lesson is judgment and isolation, not that people are safe and tools are not. Qatar’s penetration testing accreditation leaves ICS and OT testing out of what it accredits.", "sources": [ "nist80082", "seamReportMisses", "ncsaPtStandard" ], "quotes": [ { "text": "OT network owners should exercise extreme caution when permitting active scanning on an operational network due to device sensitivity on the target network. Active scans may cause device instability or interfere with the device process state, potentially impacting safety and integrity.", "source": "nist80082", "at": "NIST SP 800-82 Rev. 3, appendix E.2.3" }, { "text": "Example compensating controls include employing a replicated, virtualized, or simulated system to conduct penetration testing.", "source": "nist80082", "at": "NIST SP 800-82 Rev. 3, appendix F, CA-8" }, { "text": "Automated network scanning is not applicable to non-routable communications, such as serial networks.", "source": "nist80082", "at": "NIST SP 800-82 Rev. 3, appendix F, RA-5" }, { "text": "The penetration test locked up the SCADA system, and the utility was not able to send gas through its pipelines for four hours.", "source": "nist80082", "at": "NIST SP 800-82 Rev. 3, appendix C.3.4" }, { "text": "Penetration Testing Accreditation scope excludes following activities: Industrial Control Systems (ICS) or Operational technology (OT) Testing, Automated Vulnerability Assessment Scans", "source": "ncsaPtStandard", "at": "Qatar NCSA penetration testing accreditation standard, section 2.2" } ] }, { "id": "judgment", "title": "Deciding what a finding means for the business still takes a person", "claim": "NIST tells assessors not to accept a scanner’s risk ratings. UK firms using frontier AI told the FCA they still rely on specialists to validate findings and set priorities.", "body": "A scanner reports that a flaw is present. Whether it matters depends on what the system does, who can reach it and what stops if it is lost. NIST SP 800-115 says scanners have high false positive rates and need an expert to read them. The FCA reported in September 2026 that firms using frontier models still rely on specialist expertise to validate findings and make risk-based decisions. The PHP Foundation wrote that tools cannot decide the right fix for a long-standing design decision. The EU rules for threat-led tests choose scenarios partly on the testers’ expert judgment.", "sources": [ "nist800115", "ai-fca-frontier", "ai-php-foundation", "doraTlpt" ], "quotes": [ { "text": "Assessors should determine the appropriate risk level for each vulnerability and not simply accept the risk levels assigned by vulnerability scanners.", "source": "nist800115", "at": "NIST SP 800-115, section 4.3" }, { "text": "Although the process itself is highly automated, vulnerability scanners can have a high false positive error rate (i.e., reporting vulnerabilities when none exist). An individual with expertise in networking and OS security should interpret the results.", "source": "nist800115", "at": "NIST SP 800-115, section 4.3" }, { "text": "Models can accelerate vulnerability discovery, code analysis and inform prioritisation, but firms continue to rely on specialist expertise to validate findings, assess relevance, determine priorities and make risk-based decisions.", "source": "ai-fca-frontier", "at": "UK FCA, September 2, 2026" }, { "text": "What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch.", "source": "ai-php-foundation", "at": "The PHP Foundation, October 21, 2026" }, { "text": "the feasibility of the proposed scenarios for execution, based on the expert judgement of the testers", "source": "doraTlpt", "at": "Delegated Regulation (EU) 2025/1190, Article 10(3)(c)" } ] }, { "id": "scope", "title": "AI agents under test have crossed their scope, and human vigilance, not a technical barrier, limited the harm", "claim": "In 2026, AI systems under cyber evaluation reached real organizations. The UK AI Security Institute said its margin rested on human vigilance, not a technical barrier.", "body": "The UK AI Security Institute found 19 actions beyond the testing scope in 10 of 122 runs of one evaluation, against real people and organizations. Anthropic reported that models under evaluation gained unauthorized access to three organizations’ production systems after a misconfiguration left internet access open. In both cases scope lived in the instructions to the model. None of these runs was a commercial penetration test, and the developers’ safeguards had been switched off. The Seam Report found no public report of a commercial AI testing tool leaving scope at a client. The incidents show what an AI system that tests does when nothing outside the model holds it.", "sources": [ "ai-aisi-incident", "ai-anthropic-three-incidents", "seamReportMisses" ], "more": [ "The 2026 incidents", "/ai-testing/incidents" ], "quotes": [ { "text": "in 10 of the 122 runs, we identified 19 cases where an agent had taken distinct actions beyond the scope of the testing parameters.", "source": "ai-aisi-incident", "at": "UK AI Security Institute, August 4, 2026" }, { "text": "But in several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent.", "source": "ai-aisi-incident", "at": "UK AI Security Institute, August 4, 2026" }, { "text": "In all cases, our evaluation prompt stated explicitly that Claude had no internet access, but didn’t give Claude any limits on where to look for the flag.", "source": "ai-anthropic-three-incidents", "at": "Anthropic, July 30, 2026" } ] }, { "id": "rules", "title": "Rules written for skilled, experienced testers are not met by a scanner alone", "claim": "US, EU and Gulf texts describe penetration and red team tests as work by qualified, experienced people, and the Dubai regulator has faulted firms that only run automated scans.", "body": "NIST says penetration testing goes beyond automated vulnerability scanning. OMB requires federal agencies to use both automated tools and manual expert analysis before authorizing an application. New York requires automated scans plus a manual review of systems the scans do not cover. PCI SSC guidance describes a penetration test as a manual process that may use automated tools. When external testers run an EU threat-led test, the red team must include a manager with at least five years of experience and two testers with at least two. SAMA’s FEER asks for a red team provider with the skills, certifications and experienced staff to run the test, and Kuwait’s central bank requires a qualified team. Qatar’s penetration testing accreditation does not cover automated vulnerability scans. None of these texts sets rules for AI-driven testing, and none of the 47 testing regimes with public text that the Seam Report read does. So no regulator we read has said whether an AI-driven test meets them. CREST began accrediting firms for AI-enabled penetration testing in September 2026.", "sources": [ "nist80053", "ombM2209", "nycrr500", "dfsaThematic2024", "pciPtGuidance", "doraTlpt", "samaFeer", "cbkCorf", "seamReportMisses", "ai-crest-cohort" ], "more": [ "Rules for AI that tests", "/ai-testing/rules" ], "quotes": [ { "text": "Penetration testing goes beyond automated vulnerability scanning and is conducted by agents and teams with demonstrable skills and experience that include technical expertise in network, operating system, and/or application level security.", "source": "nist80053", "at": "NIST SP 800-53 Rev. 5, CA-8", "note": "NIST means a person or contractor here, not an AI agent. Its control CA-8(1) calls for an “independent penetration testing agent or team” and describes them as “individuals or groups who conduct impartial penetration testing”. CA-2(1), which it points to, says independent assessments can be “contracted to public or private sector entities outside of organizations”." }, { "text": "Agency system authorization processes must employ both automated analysis tools and manual expert analysis.", "source": "ombM2209", "at": "OMB M-22-09, section III.D" }, { "text": "automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities at a frequency determined by the risk assessment, and promptly after any material system changes", "source": "nycrr500", "at": "23 NYCRR 500.5(a)" }, { "text": "a number of Firms only conduct automated vulnerability scans and do not use other methods to test their critical IT infrastructure and information systems, including scenario-based testing, penetration tests and/or red team exercises.", "source": "dfsaThematic2024", "at": "DFSA Cyber Thematic Review 2024, finding 4" }, { "text": "A manual process that may include the use of vulnerability scanning or other automated tools, resulting in a comprehensive report.", "source": "pciPtGuidance", "at": "PCI SSC Penetration Testing Guidance v1.1, section 2.1" }, { "text": "is composed of at least a manager, with at least 5 years of experience in penetration testing and red team testing as well as at least two additional testers, each with penetration testing and red team testing of at least 2 years", "source": "doraTlpt", "at": "Delegated Regulation (EU) 2025/1190, Article 7(1)(f)(i)" }, { "text": "Given the fact, that these ethical hacking tests are carried out on the live production systems, it is crucial that the Red Teaming Provider has a proven track record and has the required skills, expertise, certifications and experienced staff to perform the red teaming test.", "source": "samaFeer", "at": "SAMA FEER framework, section 3.3" }, { "text": "Regulated Entities shall engage a dedicated qualified team with specialized expertise to conduct red teaming exercises.", "source": "cbkCorf", "at": "Central Bank of Kuwait CORF, 5.13.2.8" }, { "text": "The accreditation, which was launched in July 2026, assesses organisations against independent requirements for responsible, secure, and appropriate use of AI within penetration testing services.", "source": "ai-crest-cohort", "at": "CREST, September 3, 2026" } ] } ], "strengths": [ { "id": "frequency", "title": "Automated checks run every week, while a penetration test sees one day", "claim": "The UK NCSC says a penetration test validates systems only on the day of the test, often a year apart. Scanners can run on a schedule or on every change.", "body": "CISA requires US federal agencies to run automated asset discovery every 7 days and to start vulnerability enumeration across all discovered assets every 14 days. The FFIEC notes scanners can run continuously. The NCSC advises infrastructure scans at least monthly and application scans whenever the application changes. A test once a year cannot keep that pace, and the NCSC warns that vulnerabilities could then go unnoticed for long periods.", "sources": [ "ncscPentest", "ncscScanning", "cisaBod2301", "ffiecIs" ], "quotes": [ { "text": "A penetration test can only validate that your organisation's IT systems are not vulnerable to known issues on the day of the test.", "source": "ncscPentest", "at": "UK NCSC, Penetration testing" }, { "text": "It's not uncommon for a year or more to elapse between penetration tests. So, vulnerabilities could exist for long periods of time without you knowing about them if this is your only means of validating security.", "source": "ncscPentest", "at": "UK NCSC, Penetration testing" }, { "text": "You should aim to perform vulnerability scans of your infrastructure on a regular basis (at least once every month), or immediately after applying changes to remediate a critical issue.", "source": "ncscScanning", "at": "UK NCSC, Vulnerability scanning tools and services" }, { "text": "scanning can be run on a schedule, on-demand or in response to trigger events such as a new build of a software project or the deployment of a new server.", "source": "ncscScanning", "at": "UK NCSC, Vulnerability scanning tools and services" }, { "text": "Perform automated asset discovery every 7 days.", "source": "cisaBod2301", "at": "CISA BOD 23-01, required actions 1 and 2" }, { "text": "Scanners and other tools can be run continuously, generating metrics that are reported and acted upon continuously.", "source": "ffiecIs", "at": "FFIEC Information Security booklet, IV.A.2(c)" } ] }, { "id": "coverage", "title": "Scanners check known flaws on every host faster and more consistently than people", "claim": "NIST prefers automated checks wherever feasible because they are quick and repeatable. The NCSC notes scanners run hundreds or thousands of checks faster than manual testing.", "body": "A person checking hundreds of settings by hand makes mistakes. A scanner applies the same checks to every host it can reach, against known flaws and known classes of flaw. CISA asks federal agencies to enumerate vulnerabilities across all discovered assets, including laptops that roam. This is work automation should own.", "sources": [ "nist800115", "ncscScanning", "ffiecIs", "cisaBod2301" ], "quotes": [ { "text": "Generally it is preferable to use automated checks instead of manual checks whenever feasible. Automated checks can be done very quickly and provide consistent, repeatable results.", "source": "nist800115", "at": "NIST SP 800-115, section 3.4" }, { "text": "scanners typically perform hundreds or even thousands of checks at a significantly faster pace than would be possible with manual testing.", "source": "ncscScanning", "at": "UK NCSC, Vulnerability scanning tools and services" }, { "text": "Scanners search for known vulnerabilities (e.g., Mitre’s CVE) or for known vulnerability classes (e.g., Structured Query Language [SQL] injection and cross-site scripting).", "source": "ffiecIs", "at": "FFIEC Information Security booklet, IV.A.2(c)" }, { "text": "Initiate vulnerability enumeration across all discovered assets, including all discovered nomadic/roaming devices (e.g., laptops), every 14 days.", "source": "cisaBod2301", "at": "CISA BOD 23-01, required actions 1 and 2" } ] }, { "id": "speed", "title": "Exploited flaws in security products reach CISA’s list within days, so checks must run within days", "claim": "Flaws in products sold as security controls reached CISA’s exploited list a median of 2 days after publication, for 80 such flaws published from 2022 to 2025.", "body": "For all 651 exploited flaws published from 2022 to 2025, the median was 10 days. The short lag reflects how such flaws are disclosed as much as how fast attackers move. Microsoft reported in October 2026 that a state-aligned group using an AI penetration testing framework went from first targeting to privileged cloud access in less than 3 hours in several cases. A check that runs once a quarter cannot keep up with a flaw exploited the week it appears. Continuous automated checks can at least show where it is present.", "sources": [ "seamReportMisses", "ai-msft-storm0940" ], "quotes": [ { "text": "including multiple instances where the time from initial targeting to privileged access was less than 3 hours.", "source": "ai-msft-storm0940", "at": "Microsoft Threat Intelligence, October 21, 2026" } ] }, { "id": "regression", "title": "Automation confirms that fixes hold after every change", "claim": "Regulators ask for scans after material changes and for comparison with earlier scans, work that suits tools.", "body": "New York requires automated scans promptly after material system changes. Qatar’s central bank requires banks to compare results with previous scans to confirm that vulnerabilities were fixed. OWASP recommends security tests in build and release pipelines to keep a baseline and catch the easy weaknesses. Running the same checks after every change is work tools do well, and NIST calls doing it by hand tedious and error-prone.", "sources": [ "nycrr500", "qcbTechRisk", "owaspWstgIntro", "nist800115" ], "quotes": [ { "text": "automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities at a frequency determined by the risk assessment, and promptly after any material system changes", "source": "nycrr500", "at": "23 NYCRR 500.5(a)" }, { "text": "At a minimum, the bank must compare the results from previous vulnerability scans to verify that these vulnerabilities were addressed and mitigated.", "source": "qcbTechRisk", "at": "Qatar Central Bank Technology Risks regulation, 9.4.3.1" }, { "text": "consideration should be put into integrating security tests in to continuous integration/continuous deployment (CI/CD) workflows in order to maintain baseline security information/analysis and identify “low hanging fruit” type weaknesses.", "source": "owaspWstgIntro", "at": "OWASP Web Security Testing Guide v4.2, section 2.2" }, { "text": "Having a person manually checking hundreds or thousands of settings is tedious and error-prone.", "source": "nist800115", "at": "NIST SP 800-115, section 3.4" } ] }, { "id": "volume", "title": "AI tools now find real flaws in volume", "claim": "Mozilla shipped fixes for 271 vulnerabilities that an AI model identified, and UK firms told the FCA that frontier AI speeds up finding and validating flaws.", "body": "Firefox 150, released in April 2026, included fixes for 271 vulnerabilities identified by an early version of an Anthropic model during one evaluation. The FCA reported that firms find frontier AI increasingly supports the identification, validation and prioritization of vulnerabilities. The PHP Foundation says tools find bugs faster than ever, for defenders and attackers alike. The bottleneck has moved to fixing what is found.", "sources": [ "ai-mozilla-mythos", "ai-fca-frontier", "ai-php-foundation" ], "quotes": [ { "text": "This week’s release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation.", "source": "ai-mozilla-mythos", "at": "Mozilla, April 21, 2026" }, { "text": "Firms told us that frontier AI is increasingly supporting the identification, validation and prioritisation of vulnerabilities, increasing the pressure on firms’ remediation processes.", "source": "ai-fca-frontier", "at": "UK FCA, September 2, 2026" }, { "text": "Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.", "source": "ai-php-foundation", "at": "The PHP Foundation, October 21, 2026" } ] }, { "id": "simple-paths", "title": "Some intrusions needed no join, and routine checks are built for those", "claim": "Nine of 78 documented paths could have been followed end to end by one single-domain test, and four of them are fully documented.", "body": "At Colonial Pipeline and Change Healthcare, a stolen credential opened a remote access service without multi-factor authentication. Microsoft’s 2024 intrusion began with a password spray against a legacy test tenant account. In 2026, Iranian-affiliated actors altered logic on internet-exposed controllers and never left operational technology. The Seam Report says plainly that some intrusions are simple and a good penetration test would have found the door. In our reading, exposed services without MFA and controllers reachable from the internet are the common issues the NCSC says scanning finds at low cost. CISA and the FBI also recommend testing security controls continually and at scale against the techniques in their advisories, work automated tools are built for.", "sources": [ "seamReportMisses", "ncscScanning", "cisaAa23320a" ], "quotes": [ { "text": "automated scanning should be viewed as a cost-effective way of finding and managing common security issues, without needing to employ specialist security testers.", "source": "ncscScanning", "at": "UK NCSC, Vulnerability scanning tools and services" }, { "text": "The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.", "source": "cisaAa23320a", "at": "CISA and FBI advisory AA23-320A" } ] } ], "combine": [ { "id": "find-then-assure", "title": "Let tools find known flaws, and use people to test whether the program works", "claim": "The UK NCSC treats penetration testing as assurance of vulnerability management, not the main way to find vulnerabilities.", "body": "Automated scanning should carry the known flaws on every asset, every week and after every change. People then test what the scans cannot: the joins, the help desk, the door, the supplier connection and the business rules. NIST recommends regular scanning with periodic penetration tests in between. The NCSC says clearing the easy issues with scanning lets testers spend their time on problems better suited to a human.", "sources": [ "ncscPentest", "ncscScanning", "nist800115" ], "quotes": [ { "text": "Penetration testing should be viewed as a method for gaining assurance in your organisation's vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities.", "source": "ncscPentest", "at": "UK NCSC, Penetration testing" }, { "text": "by taking care of the ‘low hanging fruit’ through regular vulnerability scanning, penetration testing engagements can more efficiently focus on complicated security issues that are better suited to a human.", "source": "ncscScanning", "at": "UK NCSC, Vulnerability scanning tools and services" }, { "text": "A well-designed program of regularly scheduled network and vulnerability scanning, interspersed with periodic penetration testing, can help prevent many types of attacks and reduce the potential impact of successful ones.", "source": "nist800115", "at": "NIST SP 800-115, section 5.2.2" } ] }, { "id": "plan-both", "title": "Several rules already require both, so plan them as one program", "claim": "OMB, New York, Qatar’s central bank and the Bank of England’s CBEST guide each pair automated tools with manual work.", "body": "OMB expects agencies to move toward continuous monitoring while still running periodic manual assessments. New York pairs an annual penetration test with automated scans and manual review. Qatar’s central bank requires banks to use a combination of automated tools and manual techniques for vulnerability assessments. CBEST describes its penetration test as manual and automated techniques together. A program that buys one and calls it the other will not meet these texts.", "sources": [ "ombM2209", "qcbTechRisk", "cbestGuide" ], "quotes": [ { "text": "Agencies are expected to continue moving toward continuous monitoring and ongoing authorizations while employing periodic manual security assessments as applications, dependencies, components, and infrastructure evolve.", "source": "ombM2209", "at": "OMB M-22-09, section III.D" }, { "text": "The bank shall deploy a combination of automated tools and manual techniques to perform a comprehensive Vulnerability Assessment (VA) exercise", "source": "qcbTechRisk", "at": "Qatar Central Bank Technology Risks regulation, 9.4.3.1" }, { "text": "A Penetration Test involves the use of a variety of manual and automated techniques to simulate an attack on an organisation’s IBSs.", "source": "cbestGuide", "at": "CBEST Implementation Guide, section 8" } ] }, { "id": "aim-at-seams", "title": "Aim human-led tests at the crossings tools cannot reach", "claim": "Plan people’s time from a register of seams, and arrange the authority to cross them before the test starts.", "body": "The Seam Report proposes a seam register: one row per crossing between domains or owners, with a named owner on each side and the date it was last crossed in a test. Scenarios start from a crossing, such as a caller asking the service desk to reset a privileged user’s MFA, or a device left in a meeting room. Contracts with suppliers can carry the right to run joint scenarios. The method is a proposal and is itself untested. It does not replace penetration testing.", "sources": [ "seamReportMisses" ], "more": [ "The Seam Report 2026", "/research" ] }, { "id": "controls-for-ai", "title": "Hold AI-driven testing to controls that sit outside the model", "claim": "Require scope that the system enforces, a stop the client holds and a qualified person who checks every finding.", "body": "The Seam Report proposes ten controls for AI systems that test. The first is a target list the system refuses to pass, not an instruction in a prompt. The last is a qualified tester who checks every finding. After its incident, the UK AI Security Institute added monitoring that can block out-of-scope actions as they happen. These are Bendings’ proposals, and no regulator has adopted them.", "sources": [ "seamReportMisses", "ai-aisi-incident" ], "more": [ "Ten controls for AI that tests", "/ai-testing/controls" ], "quotes": [ { "text": "We are introducing monitoring built to watch an evaluation as it runs, able to flag or block out-of-scope actions as they happen.", "source": "ai-aisi-incident", "at": "UK AI Security Institute, August 4, 2026" } ] } ], "faq": [ { "q": "Is automated penetration testing enough?", "a": "Not on its own. Automated and AI-driven tools check known flaws on systems you own often, quickly and consistently, and regulators encourage that. Scanners do not test the staff who reset credentials, physical entry, supplier systems you cannot authorize, or business rules, and no regulator or standards body has said AI-driven tools do. Documented intrusions ran through those joins. NIST, OMB and New York each pair automated tools with manual work, and Qatar’s central bank requires banks to use “a combination of automated tools and manual techniques” for vulnerability assessments (9.4.3.1).", "sources": [ "nist800115", "ombM2209", "nycrr500", "qcbTechRisk", "seamReportMisses" ] }, { "q": "What does automated testing do better than a human tester?", "a": "Frequency, coverage, repeat checks and speed. US federal agencies must run automated asset discovery every 7 days and vulnerability enumeration every 14. Scanners run hundreds or thousands of checks faster than manual testing, give repeatable results and can run after every change. AI tools now find real flaws in volume: Mozilla fixed 271 vulnerabilities that one AI model identified.", "sources": [ "cisaBod2301", "ncscScanning", "nist800115", "ai-mozilla-mythos" ] }, { "q": "Can AI-driven penetration testing replace a red team?", "a": "No regulator we read has said so. Of the 50 testing regimes in The Seam Report 2026, none of the 47 with public text sets rules for AI-driven testing, and threat-led schemes such as DORA, TIBER-EU and SAMA’s FEER describe tests run by experienced people. In 2026, AI systems under cyber evaluation reached real organizations when nothing outside the model enforced scope. None of those was a commercial test. CREST began accrediting firms for AI-enabled penetration testing in September 2026.", "sources": [ "seamReportMisses", "doraTlpt", "tiberEu", "samaFeer", "ai-aisi-incident", "ai-anthropic-three-incidents", "ai-crest-cohort" ] }, { "q": "Will a regulator accept automated scans in place of a penetration test?", "a": "Not in the texts we read. The Dubai Financial Services Authority faulted firms that only run automated scans. Qatar’s penetration testing accreditation excludes automated vulnerability scans. PCI SSC guidance describes a penetration test as a manual process that may use automated tools. NIST says penetration testing goes beyond automated vulnerability scanning.", "sources": [ "dfsaThematic2024", "ncsaPtStandard", "pciPtGuidance", "nist80053" ] }, { "q": "Which parts of an attack path does automated testing not reach?", "a": "The help desk that resets a password on a caller’s word, the door or lobby port, systems a supplier runs that the client cannot authorize testing of, business rules an application should enforce, and live operational technology where an active scan can upset a controller. Of 78 documented intrusion paths, 38 ran through systems or people the victim did not own.", "sources": [ "cisaAa23320a", "nist80053", "seamReportMisses", "owaspWstgLogic", "nist80082" ] }, { "q": "How should automated and human-led testing be combined?", "a": "Let automation carry known flaws on every asset, every week and after every change. Use people to test what scans cannot reach and to judge what findings mean. The UK NCSC treats penetration testing as assurance of vulnerability management rather than the main way to find flaws. Hold any AI-driven testing to scope enforced outside the model, a stop the client holds and human sign-off on every finding.", "sources": [ "ncscPentest", "nist800115", "seamReportMisses" ] }, { "q": "Does Bendings use automation?", "a": "Yes. Its own AI model, Bendings Gauge, runs continuous red and blue team work inside limits each client approves. Exploitation, lateral movement and other risky actions wait for a Bendings operator to approve them. Bendings also runs reconnaissance, red team, penetration testing, physical and social-engineering testing, blue team support and incident response for governments, banks and asset managers in the United States and the Gulf Cooperation Council states.", "sources": [] } ] }, "sources": { "ai-hf-disclosure": { "title": "Security incident disclosure, July 2026, Hugging Face, July 16, 2026", "url": "https://huggingface.co/blog/security-incident-july-2026", "checked": "2026-10-30" }, "ai-hf-timeline": { "title": "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident, Hugging Face, July 27, 2026", "url": "https://huggingface.co/blog/agent-intrusion-technical-timeline", "checked": "2026-09-28" }, "ai-openai-hf": { "title": "OpenAI and Hugging Face partner to address security incident during model evaluation, OpenAI, July 21, 2026", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/", "checked": "2026-09-28" }, "ai-openai-road-ahead": { "title": "The Hugging Face incident and the road ahead, OpenAI, August 26, 2026", "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/", "checked": "2026-09-28" }, "ai-metr-hf": { "title": "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, METR with Redwood Research, August 26, 2026", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/", "checked": "2026-09-28" }, "ai-anthropic-three-incidents": { "title": "Investigating three real-world incidents in our cybersecurity evaluations, Anthropic, July 30, 2026", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals", "checked": "2026-10-30" }, "ai-aisi-incident": { "title": "Incident Report: unsanctioned agent behaviour during cyber testing, UK AI Security Institute, August 4, 2026", "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing", "checked": "2026-10-30" }, "ai-aisi-incident-report": { "title": "Security Incident INC-2026-07-28-01, preliminary technical report, UK AI Security Institute, August 4, 2026", "url": "https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf", "checked": "2026-09-28" }, "ai-msft-2024": { "title": "Staying ahead of threat actors in the age of AI, Microsoft Threat Intelligence, February 14, 2024", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "checked": "2026-09-28" }, "ai-openai-2024-02": { "title": "Disrupting malicious uses of AI by state-affiliated threat actors, OpenAI, February 14, 2024", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "checked": "2026-09-28" }, "ai-anthropic-2025-08": { "title": "Detecting and countering misuse of AI: August 2025, Anthropic, August 27, 2025", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "checked": "2026-09-28" }, "ai-anthropic-gtg1002": { "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign, Anthropic, November 13, 2025", "url": "https://www.anthropic.com/news/disrupting-AI-espionage", "checked": "2026-09-28" }, "ai-gtig-2026-05": { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access, Google Threat Intelligence Group, May 12, 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "checked": "2026-09-28" }, "ai-gtig-2026-09": { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy, the Evolution of Adversarial AI, Google Threat Intelligence Group, September 9, 2026", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "checked": "2026-09-28" }, "ai-anthropic-tir-2026-09": { "title": "Detecting and countering misuse of AI: September 2026, Anthropic, September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "checked": "2026-09-28" }, "ai-dragos-water": { "title": "AI in the Breach: How an Adversary Leveraged AI to Target a Water Utility's OT, Dragos, May 6, 2026", "url": "https://www.dragos.com/blog/ai-assisted-ics-attack-water-utility", "checked": "2026-09-28" }, "ai-cato-wormgpt": { "title": "Cato CTRL Threat Research: WormGPT Variants Powered by Grok and Mixtral, Cato Networks, June 17, 2025", "url": "https://www.catonetworks.com/blog/cato-ctrl-wormgpt-variants-powered-by-grok-and-mixtral/", "checked": "2026-09-28" }, "ai-trend-xanthorox": { "title": "The Devil Reviews Xanthorox: A Criminal-Focused Analysis of the Latest Malicious LLM Offering, Trend Micro, November 11, 2025", "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-devil-reviews-xanthorox-a-criminal-focused-analysis-of-the-latest-malicious-llm-offering", "checked": "2026-09-28" }, "ai-trend-criminal-ai": { "title": "An Update on the State of Criminal AI: Crime as a Service, AI as the Multiplier, Trend Micro, January 28, 2026", "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-state-of-criminal-ai", "checked": "2026-09-28" }, "ai-rapid7-criminal-ai": { "title": "Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime, Rapid7, June 11, 2026", "url": "https://www.rapid7.com/blog/post/tr-criminal-ai-underground-market-operationalizing-cybercrime-2026/", "checked": "2026-09-28" }, "ai-certua-lamehug": { "title": "Cyberattacks by UAC-0001 on the security and defence sector using LAMEHUG, a program that uses an LLM (CERT-UA#16039), CERT-UA, July 17, 2025", "url": "https://cert.gov.ua/article/6284730", "checked": "2026-09-28" }, "ai-openai-2025-06": { "title": "Disrupting malicious uses of AI: June 2025, OpenAI, June 5, 2025", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf", "checked": "2026-09-28" }, "ai-aisi-open-gap": { "title": "How Far Behind the Frontier are Leading Open Weight Models on Cyber?, UK AI Security Institute, July 17, 2026", "url": "https://www.aisi.gov.uk/blog/how-far-behind-the-frontier-are-leading-open-weight-models-on-cyber", "checked": "2026-09-28" }, "ai-caisi-kimi-k3": { "title": "UK AISI / CAISI Preliminary Assessment of Kimi K3's Cyber Capabilities, NIST CAISI and UK AI Security Institute, July 23, 2026", "url": "https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber-capabilities", "checked": "2026-09-28" }, "ai-darpa-aixcc": { "title": "AI Cyber Challenge marks pivotal inflection point for cyber defense, DARPA, August 8, 2025", "url": "https://www.darpa.mil/news/2025/aixcc-results", "checked": "2026-09-28" }, "ai-google-bigsleep-2025": { "title": "Google's latest AI security announcements, Google, July 2025", "url": "https://blog.google/technology/safety-security/cybersecurity-updates-summer-2025/", "checked": "2026-09-28" }, "ai-bis-129": { "title": "A Mythos moment? Frontier AI and cyber risk (BIS Bulletin No 129), Bank for International Settlements, July 20, 2026", "url": "https://www.bis.org/publications/bulletin-129-mythos-moment-frontier-ai-and-cyber-risk.pdf", "checked": "2026-09-28" }, "ai-msrc-echoleak": { "title": "M365 Copilot Information Disclosure Vulnerability, CVE-2025-32711, Microsoft Security Response Center, June 11, 2025", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711", "checked": "2026-09-28" }, "ai-nvd-api": { "title": "NVD CVE API 2.0 and JSON 2.0 feeds, keyword and full-text counts, National Institute of Standards and Technology, September 28, 2026", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0", "checked": "2026-09-28" }, "ai-nx-advisory": { "title": "Malicious versions of Nx were published (GHSA-cxm3-wv7p-598c), GitHub Advisory Database, August 27, 2025", "url": "https://github.com/advisories/GHSA-cxm3-wv7p-598c", "checked": "2026-09-28" }, "ai-nx-postmortem": { "title": "s1ngularity postmortem, Nx, 2025", "url": "https://nx.dev/blog/s1ngularity-postmortem", "checked": "2026-09-28" }, "ai-five-eyes-agentic": { "title": "Careful adoption of agentic AI services, ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK, May 1, 2026", "url": "https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF", "checked": "2026-09-28" }, "ai-cbuae-ai-guidance": { "title": "Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., Central Bank of the UAE, February 11, 2026", "url": "https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence", "checked": "2026-09-28" }, "ai-qcb-ai-guideline": { "title": "Artificial Intelligence Guideline, Qatar Central Bank, September 4, 2024", "url": "https://www.qcb.gov.qa/Services/Financial%20Technology/QCB_Artificial_Intelligence_Guideline.pdf", "checked": "2026-09-28" }, "ai-nca-aicg-draft": { "title": "Draft of AI Cybersecurity Guidelines (AICG-1:2026), public consultation draft, National Cybersecurity Authority, Saudi Arabia, July 2026", "url": "https://cdn.nca.gov.sa/api/files/public/upload/9ae38ab1-64b4-498e-ab30-f054d3a88adb_AI_Cybersecurity_Controls_EN.pdf", "checked": "2026-09-28" }, "ai-fsb-ai": { "title": "Sound Practices for Responsible Adoption of Artificial Intelligence (AI), consultation report, Financial Stability Board, June 10, 2026", "url": "https://www.fsb.org/uploads/P100626.pdf", "checked": "2026-10-30" }, "ai-sr-26-2": { "title": "Supervisory Guidance on Model Risk Management (SR 26-2 attachment), Federal Reserve, FDIC and OCC, April 17, 2026", "url": "https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf", "checked": "2026-09-28" }, "ai-crest-principles": { "title": "CREST's principles for AI-enabled activities, CREST, May 22, 2026", "url": "https://www.crest-approved.org/crests-principles-for-ai-enabled-activities/", "checked": "2026-09-28" }, "ai-crest-cohort": { "title": "CREST announces first cohort of companies to achieve new AI-Enabled Penetration Testing accreditation, CREST, September 3, 2026", "url": "https://www.crest-approved.org/crest-first-ai-pt-accredited-members/", "checked": "2026-10-30" }, "ai-iteuropa-crest": { "title": "CREST adds AI checks to cybersecurity accreditation, IT Europa, July 29, 2026", "url": "https://www.iteuropa.com/news/crest-adds-ai-checks-cybersecurity-accreditation", "checked": "2026-09-28", "secondary": true }, "ai-thenational-uae-2026-02": { "title": "UAE foils AI-powered 'terrorist cyber attacks' on vital sectors, The National, February 22, 2026", "url": "https://www.thenationalnews.com/news/uae/2026/02/22/uae-foils-ai-powered-terrorist-cyberattacks-on-vital-sectors/", "checked": "2026-09-28", "secondary": true }, "ai-msft-storm0940": { "title": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, Microsoft Threat Intelligence, October 21, 2026", "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "checked": "2026-10-30" }, "ai-crowdstrike-agentic": { "title": "CrowdStrike Uncovers New Agentic AI Campaigns, CrowdStrike, October 21, 2026", "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/", "checked": "2026-10-26" }, "ai-mozilla-mythos": { "title": "The zero-days are numbered, Mozilla, April 21, 2026", "url": "https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/", "checked": "2026-10-30" }, "ai-fca-frontier": { "title": "Frontier AI and cyber resilience, Financial Conduct Authority, September 2, 2026", "url": "https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience", "checked": "2026-10-30" }, "ai-php-advisory": { "title": "Security advisory: Critical remote code execution vulnerabilities, update now, The PHP Group, php.net, October 21, 2026", "url": "https://www.php.net/archive/2026.php#2026-10-21-5", "checked": "2026-10-26" }, "ai-php-foundation": { "title": "Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, October 21, 2026", "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/", "checked": "2026-10-30" }, "ai-w3techs-php": { "title": "Usage Statistics and Market Share of PHP for Websites, October 2026, W3Techs, October 26, 2026", "url": "https://w3techs.com/technologies/details/pl-php", "checked": "2026-10-26" }, "ai-hansard-php": { "title": "Cyber Security: PHP Vulnerability, House of Lords, volume 860, UK Parliament, Hansard, October 22, 2026", "url": "https://hansard.parliament.uk/Lords/2026-10-22/debates/14CB4C6D-4E16-4377-8FCF-C2CF77BB5CC0/details", "checked": "2026-10-26" }, "ai-aws-madpot": { "title": "Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, Amazon Web Services, October 21, 2026", "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/", "checked": "2026-10-26" }, "ai-ncsc-nl-php": { "title": "Update: PHP vulnerabilities remain a reason for immediate patching, National Cyber Security Centre, Netherlands, October 23, 2026", "url": "https://www.ncsc.nl/en/alerts/update-php-vulnerabilities-remain-a-reason-for-immediate-patching", "checked": "2026-10-26" }, "ai-nodejs-oct": { "title": "Wednesday, October 21, 2026 Security Releases, Node.js, October 21, 2026", "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "checked": "2026-10-26" }, "ai-dotnet-brotli": { "title": "Microsoft Security Advisory CVE-2026-111497, .NET Brotli Decoder Out-of-bounds Write Vulnerability, Microsoft, dotnet/runtime, October 25, 2026", "url": "https://github.com/dotnet/runtime/security/advisories/GHSA-p3jp-9v83-76w9", "checked": "2026-10-26" }, "ai-crowdstrike-php2shell": { "title": "Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation, CrowdStrike, October 23, 2026", "url": "https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/", "checked": "2026-10-26" }, "ai-unit42-php": { "title": "Threat Brief: Critical Vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 (updated October 25), Palo Alto Networks Unit 42, October 25, 2026", "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "checked": "2026-10-26" }, "seamReport": { "title": "The Seam Report 2026, Bendings, chapter 8 (AI) and chapter 9 (testing rules)", "url": "https://bendings.com/research", "checked": "2026-10-30" }, "seamReportMisses": { "title": "The Seam Report 2026, Bendings, chapters 2, 3, 4, 6, 8, 9 and 12", "url": "https://bendings.com/research", "checked": "2026-10-30" }, "testingRules": { "title": "Security testing rules, United States and the Gulf, Bendings, reviewed October 30, 2026", "url": "https://bendings.com/testing-rules", "checked": "2026-10-30" }, "crestLaunch": { "title": "CREST launches new AI accreditation, CREST, July 28, 2026", "url": "https://www.crest-approved.org/crest-launches-new-ai-accreditation/", "checked": "2026-10-30" }, "nydfsAi": { "title": "Heightened cybersecurity risks associated with frontier AI models, NYDFS industry letter, May 21, 2026", "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/20260521-heightened-cybersecurity-risks-assoc-with-frontier-ai-models", "checked": "2026-09-28" }, "eo14409": { "title": "Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security, June 2, 2026", "url": "https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/", "checked": "2026-09-28" }, "bahrainAi": { "title": "General Policy for the Use of Artificial Intelligence, v1.0, Information & eGovernment Authority, Bahrain, May 20, 2025", "url": "https://www.iga.gov.bh/Media/Publications/National%20Digital%20Policies/General%20Policy%20for%20the%20Use%20of%20AI%20-%20%20Final%2030%20Jul%202025.pdf", "checked": "2026-09-28" }, "ncsaAi": { "title": "Guidelines for Secure Adoption and Usage of Artificial Intelligence, v1.0, National Cyber Security Agency, Qatar, February 2024", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/9729/1.0~4da3f415-18ce-4925-8ae9-b18d4f26edc9?mimetype=application/pdf&filename=CSSP_Guidelines_for_Secure_Usage_and_Adoption_of_AI.pdf", "checked": "2026-09-28" }, "descAi": { "title": "Dubai Electronic Security Center launches the Dubai AI Security Policy, DESC, September 20, 2024", "url": "https://www.desc.gov.ae/dubai-electronic-security-center-launches-the-dubai-ai-security-policy/", "checked": "2026-09-28" }, "sdaiaAgentic": { "title": "Study on agentic AI (Arabic), Saudi Data and AI Authority, July 2025", "url": "https://sdaia.gov.sa/ar/MediaCenter/KnowledgeCenter/ResearchLibrary/Agentic_AI_090725.V.pdf", "checked": "2026-09-28" }, "owaspLlm": { "title": "OWASP Top 10 for LLM Applications 2025, OWASP", "url": "https://genai.owasp.org/llm-top-10/", "checked": "2026-10-30" }, "fsbAiFinal": { "title": "Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report, Financial Stability Board, October 15, 2026", "url": "https://www.fsb.org/uploads/P151026-1.pdf", "checked": "2026-10-30" }, "owaspRtManual": { "title": "GenAI Red Teaming Manual, version 1.0, OWASP Gen AI Security Project, October 20, 2026", "url": "https://genai.owasp.org/resource/genai-red-teaming-manual-version-1-0/", "checked": "2026-10-30" }, "nistAi100_2": { "title": "NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST, March 2025", "url": "https://csrc.nist.gov/pubs/ai/100/2/e2025/final", "checked": "2026-10-30" }, "euAiAct": { "title": "Regulation (EU) 2024/1689, the Artificial Intelligence Act, Official Journal of the European Union, July 12, 2024", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "checked": "2026-10-30" }, "mitreAtlas": { "title": "MITRE ATLAS data, release manifest, MITRE", "url": "https://github.com/mitre-atlas/atlas-data/blob/main/dist/manifest.yaml", "checked": "2026-10-30" }, "nist800115": { "title": "NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, NIST, September 2008", "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf", "checked": "2026-10-30" }, "nist80053": { "title": "NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, NIST, September 2020, updated December 10, 2020", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf", "checked": "2026-10-30" }, "nist80082": { "title": "NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, NIST, September 2023", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf", "checked": "2026-10-30" }, "owaspWstgLogic": { "title": "Web Security Testing Guide v4.2, 4.10.0 Introduction to Business Logic, OWASP Foundation, 2020", "url": "https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/10-Business_Logic_Testing/00-Introduction_to_Business_Logic/", "checked": "2026-10-30" }, "owaspWstgIntro": { "title": "Web Security Testing Guide v4.2, 2. Introduction, OWASP Foundation, 2020", "url": "https://wstg.owasp.org/v4.2/2-Introduction/", "checked": "2026-10-30" }, "ffiecIs": { "title": "IT Examination Handbook, Information Security booklet, FFIEC, September 2016", "url": "https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf", "checked": "2026-09-28" }, "cisaAa23320a": { "title": "Scattered Spider, joint advisory AA23-320A, CISA, FBI and partners, November 16, 2023, updated July 29, 2025", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a", "checked": "2026-10-30" }, "cbestThematic2025": { "title": "2025 CBEST thematic, Bank of England, PRA and FCA, last updated January 20, 2026", "url": "https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/2025-cbest-thematic", "checked": "2026-10-30" }, "cbestGuide": { "title": "CBEST Implementation Guide, Bank of England and PRA, 2024", "url": "https://www.bankofengland.co.uk/-/media/boe/files/financial-stability/financial-sector-continuity/cbest-implementation-guide.pdf", "checked": "2026-10-30" }, "fbiAtm": { "title": "Increase in Malware Enabled ATM Jackpotting Incidents Across United States, FLASH-20260219-001, FBI, February 19, 2026", "url": "https://www.ic3.gov/CSA/2026/260219.pdf", "checked": "2026-10-30" }, "doraTlpt": { "title": "Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing, Official Journal of the European Union, June 18, 2025", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng", "checked": "2026-09-28" }, "tiberEu": { "title": "TIBER-EU Framework, European Central Bank, January 2025", "url": "https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework_2025~b32eff9a10.en.pdf", "checked": "2026-10-30" }, "samaFeer": { "title": "Financial Entities Ethical Red-Teaming framework, v1.0, Saudi Central Bank (SAMA), May 2019", "url": "https://rulebook.sama.gov.sa/sites/default/files/ar_net_file_store/SAMA_AR_2898_VER1.pdf", "checked": "2026-10-30" }, "cbkCorf": { "title": "Cyber and Operational Resilience Framework, v1.0, Central Bank of Kuwait, December 3, 2025", "url": "https://www.cbk.gov.kw/en/images/corf-170113_v10_tcm10-170113.pdf", "checked": "2026-10-30" }, "qcbTechRisk": { "title": "Technology Risks regulation for banks, Qatar Central Bank, January 2018", "url": "https://www.qcb.gov.qa/Documents/InformationSecurity/Technology%20Risks%20Regulation%20Banks.pdf", "checked": "2026-10-30" }, "ncsaPtStandard": { "title": "NISCF Accreditation Penetration Testing Standard, V1.1, National Cyber Security Agency, Qatar, February 8, 2024", "url": "https://ncsa.gov.qa/shared/document_library/94787172324409/33000/3861/1.0~1fca5e63-9fff-4172-82c5-422b356ef221?mimetype=application/pdf&filename=SD.pdf", "checked": "2026-10-30" }, "dfsaThematic2024": { "title": "Cyber Thematic Review 2024, Key Findings and Observations, Dubai Financial Services Authority, 2024", "url": "https://www.dfsa.ae/download_file/3762/0", "checked": "2026-09-28" }, "ombM2209": { "title": "OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, Office of Management and Budget, January 26, 2022", "url": "https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf", "checked": "2026-10-30" }, "nycrr500": { "title": "23 NYCRR Part 500 as amended, NYDFS, November 1, 2023 (department copy, not an official version)", "url": "https://www.dfs.ny.gov/system/files/documents/2026/07/NYCRR-part-500-Cybersecurity-Regulation.pdf", "checked": "2026-09-28" }, "pciPtGuidance": { "title": "Information Supplement: Penetration Testing Guidance, v1.1, PCI Security Standards Council, September 2017", "url": "https://www.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf", "checked": "2026-10-30" }, "ncscPentest": { "title": "Penetration testing, National Cyber Security Centre (UK), August 8, 2017, reviewed January 10, 2022", "url": "https://www.ncsc.gov.uk/guidance/penetration-testing", "checked": "2026-10-30" }, "ncscScanning": { "title": "Vulnerability scanning tools and services, National Cyber Security Centre (UK), January 19, 2021", "url": "https://www.ncsc.gov.uk/guidance/vulnerability-scanning-tools-and-services", "checked": "2026-10-30" }, "cisaBod2301": { "title": "Binding Operational Directive 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks, CISA, October 3, 2022", "url": "https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks", "checked": "2026-10-30" } } }