AI Penetration Testing: From Vulnerabilities to Attack Paths
Why autonomous AI penetration testing doesn't just find more weaknesses — it reasons about how an attacker would chain them into genuine business risk, and reports validated attack paths, not isolated findings.
AI penetration testing represents a fundamental shift from traditional penetration testing and manual pen testers. Security testing has spent two decades getting better at producing lists. Vulnerability scanning tools enumerate common vulnerabilities and potential vulnerabilities; human pen testers rank security vulnerabilities by severity. Yet real cyberattacks are rarely the result of a single catastrophic flaw – they are the product of several moderate ones, combined in sequence by an attacker with an objective in mind. This paper sets out why enumeration alone understates real exposure, and introduces Arcseer Strike: an AI-powered penetration testing capability powered by autonomous agents and artificial intelligence that builds and continuously updates a working model of the target environment, reasons about the most likely path to a meaningful business outcome, and reports risk as validated attack paths rather than isolated findings – all under CREST-certified human oversight.
Understanding Security Threats and Vulnerabilities
What Actually Constitutes Risk?
To reason about security assessments and penetration testing, it helps to start with the definition of risk itself – and in particular risk from a cybersecurity perspective.
I have always liked the way NIST frames it: a threat actor acting against a vulnerability is what produces risk. The framing is useful precisely because of what it excludes. With no capable threat actor, it barely matters that a security vulnerability exists – no one is positioned to take advantage of it. The exploitable weakness is real, but the risk is close to theoretical.
That relationship has a second, less obvious consequence. A single misconfiguration might be reachable by almost anyone. But a complex, multi-stage attack chain is only within reach of the smaller set of actors capable of executing every step of it. As a path grows longer and more contingent, the population of threat actors who can realistically walk it narrows. Risk is therefore not a property of a vulnerability in isolation – it is a property of the path, and of who can travel it.
Figure 01 — Risk is a property of the path, not the flaw. The longer and more contingent the attack path, the smaller the population of threat actors able to execute every step. Risk emerges from the pairing of a capable actor with a reachable path – not from the raw count of security vulnerabilities.
Traditional Penetration Testing: Coverage versus Compromise
The Challenge of Manual Penetration Testing
A traditional penetration testing engagement has always been, at its core, about exploitation. But in execution it is a constant balancing act: covering as much of the attack surface as possible, versus demonstrating that a system can actually be compromised. Push too far toward coverage and the test becomes a broad but shallow inventory. Push too far toward compromise and large parts of the surface go unexamined.
Red teaming evolved partly out of this same dichotomy. In the early days we used the phrase “this is not a pen test” so often it became a mantra – a way of keeping teams focused on the fact that successfully compromising a network was the means, not the end game. The objective was to demonstrate impact against something the business cared about.
The pressure to cover ground has a cost that rarely gets named. Because so much effort goes into breadth, many traditional pentesting engagements never quite join the dots in the report. They surface a long list of security vulnerabilities without demonstrating how chaining a specific subset of them together would let an attacker compromise a significant business function or capability. The individual findings are all correct. The narrative that turns them into a business risk is the part that gets lost.
None of this is a criticism of the discipline. Even with that gap, traditional penetration testing has consistently delivered value many times over what vulnerability scanning tools offer. The point is narrower: the highest-value output of a test – the validated path to impact – is also the hardest to produce at scale, and the first thing sacrificed under time pressure.
Enumeration Produces Lists. Attackers Produce Paths.
Limitations of Automated Vulnerability Discovery
Traditional vulnerability scanners are enumeration engines. They are very good at what they do, and what they do is produce a list of common vulnerabilities and potential vulnerabilities through automated vulnerability discovery:
- An outdated VPN appliance
- A weak Active Directory configuration
- An exposed development server
- An over-privileged cloud account
- A publicly accessible storage bucket
Each finding is treated independently, scored independently, and handed on. It is then left to ethical hackers or human pen testers to work out whether those issues can be combined into a realistic attack – and, as we have seen, that synthesis is exactly the step most likely to be squeezed out.
How Attackers Reason About Security Posture
The difference between how a scanner sees an environment and how an attacker sees it is the difference between a list and a graph. The attacker does not care about your findings inventory. They care about which exploitable weakness leads to the next, and where that sequence terminates. This is where AI-powered penetration testing and artificial intelligence technology change the equation – by reasoning about security vulnerabilities the way threat actors do.
Figure 02 — The same findings, seen two ways. A scanner sees five independent, mostly-moderate findings. An attacker sees one path. The findings are identical; the risk they describe is not. The severity of the chain exceeds the severity of any link within it.
AI-Powered Penetration Testing: A Different Question
Arcseer Strike takes a fundamentally different approach. Rather than asking “what vulnerabilities exist?”, it asks:
Given everything we’ve learned so far, what is the most likely path an attacker would take to achieve a meaningful business objective?
Building an Attack Model with AI Agents
As an assessment progresses, Arcseer Strike continuously builds a working model of the organisation. It tracks the relationships between internet-facing applications, cloud infrastructure, identities, credentials, APIs, trust boundaries and business systems. Every new piece of evidence updates that model, so each subsequent decision is made using everything already learned – rather than treating each finding in isolation.
This lets Arcseer Strike reason much as an experienced pen tester does. When it discovers a weakness, it does not stop and log it. It asks the only question that matters to an attacker:
What does this enable me to do next?
How AI Pen Testing Works
Rather than simply launching security tools in a fixed order, Arcseer Strike follows a structured methodology designed specifically for autonomous, AI-led testing. It has three phases – but the middle phase is a loop, not a step.
Figure 03 — Scope in, methodology out — then the loop runs.
Phase 1: Planning and Attack Surface Analysis
The Plan phase is not a single step but a short sequence. Arcseer Strike first ingests the scope of the engagement, then undertakes initial reconnaissance to establish what is actually present – the likely attack surfaces, the probable technologies in play, the relevant trust boundaries and the business objectives worth targeting. Only then, informed by what reconnaissance reveals rather than by assumption, does it formulate the methodology for the complete test using the Arcseer Methodology – a framework developed from decades of offensive security experience and refined specifically for AI-led testing. The result is a hypothesis and a tailored plan of attack before live testing begins, much as an experienced consultant sizes up a target before touching a keyboard.
Phase 2: Continuous Testing and Autonomous Agents
Arcseer Strike then enters an iterative orchestration-and-reasoning loop. Rather than executing tools in a fixed sequence, each tool is selected because of what has already been discovered. Every execution produces new evidence; every piece of evidence updates the model of the environment; every update influences the next decision. The assessment becomes a continuous cycle of observation, reasoning and action rather than a static checklist of tests. Our autonomous agents are designed to perform threat intelligence analysis and continuously reasoning about the attack surface.
Figure 04 — The orchestration & reasoning loop. Each observation feeds the model; the model shapes the next action. Discovering credentials, for example, immediately prompts the question of where else those credentials might be valid – and the next test follows from the answer.
Phase 3: Analysis and Risk Reporting
Once no further meaningful attack paths remain, Arcseer Strike analyses the complete body of evidence and reconstructs the attack paths validated during testing. Rather than presenting hundreds of isolated findings, it explains how seemingly unrelated exploitable weaknesses combine to create genuine business risk – letting organisations prioritise remediation based on real-world attacker behaviour rather than individual CVSS scores.
Azure Environment Compromise: From Vulnerabilities to Production Control
Consider a fairly typical enterprise: Microsoft Entra ID and Microsoft 365, a customer application hosted in Azure Kubernetes Service, an Azure SQL Database, Azure Key Vault, GitHub Actions for deployment, and Microsoft Defender in place.
During testing, Arcseer Strike discovers four findings – an outdated application component, a managed identity with excessive permissions, a Key Vault that trusts that identity, and a service principal with deployment permissions. Assessed individually, none is necessarily business-critical.
Arcseer Strike reasons about how they relate. Exploiting the web application provides access to the managed identity. That identity can retrieve secrets from Key Vault. Those secrets grant access to the deployment pipeline, which in turn allows trusted code to be pushed into production.
Chaining Multiple Vulnerabilities Into a Critical Path
Figure 05 — Four medium findings → one production compromise. What appeared to be four medium-severity findings is a validated path to persistent control of production. The output is not three misconfigurations – it is a single business risk.
An external attacker could obtain persistent control of the production environment by chaining together four individually moderate security vulnerabilities, enabling malicious code deployment into customer-facing applications.
Ransomware Path Through Hybrid Enterprise: Disabling Recovery Systems
Consider a second organisation: Microsoft Entra ID alongside Windows Active Directory, VPN access for remote users, Microsoft Defender, VMware infrastructure, file servers, Microsoft 365 and a backup platform.
Arcseer Strike discovers a phishing-resistant MFA exception on a legacy VPN account, local administrator password reuse across servers, an over-privileged service account, and insufficient separation between server administration and backup infrastructure. Again, none alone appears catastrophic.
Reasoning through the relationships: the VPN account provides an initial foothold; the reused administrator credentials enable lateral movement between servers; the service account grants elevated privileges within Active Directory; and those privileges ultimately provide administrative access to the backup platform, allowing backups to be disabled before ransomware is deployed.
Attack Path: Foothold to Business Impact
Figure 06 — From one remote account to disabled recovery. The report no longer describes four separate weaknesses. It describes one attacker journey – and the fact that recovery is neutralised before encryption is what turns an incident into a crisis.
An attacker could progress from a single compromised remote user account to full domain compromise, and disable recovery systems before deploying ransomware – significantly increasing operational disruption and recovery costs.
The Race Director Model: Human Oversight of Autonomous Penetration Testing
Autonomy at machine speed is only valuable if it is directed and accountable. Arcseer Strike runs its orchestration-and-reasoning loop far faster and more exhaustively than a human could sustain, but it does not operate unsupervised. A certified practitioner sits over the engagement in what we call the Race Director role – setting objectives and rules of engagement, steering the assessment, validating the paths the AI reconstructs, and standing behind the findings.
Ethical Hackers Directing AI Systems
The analogy is deliberate. A race director does not drive the car; they run the race – setting the conditions, watching every position on the track at once, and making the calls that keep it safe and legitimate. Arcseer Strike covers the ground; the practitioner ensures the result is one a security leader can act on with confidence, and one that meets the assurance standards their stakeholders expect.
From Finding Weaknesses to Understanding Attacks
These examples illustrate the fundamental difference between traditional security testing and AI-driven penetration testing. Traditional pentesting tools identify security vulnerabilities. Arcseer Strike identifies how attackers combine them.
Real-World Attack Scenarios and Remediation Strategy
That shift – from cataloguing individual exploitable weaknesses to understanding complete world attack scenarios and cyberattacks – is what lets security teams prioritise remediation based on genuine business risk rather than treating every security vulnerability as an isolated problem. It also changes the economics of the remediation conversation. Break one link in a validated chain and the whole path collapses, which means the most valuable fix is rarely the highest-scoring finding in isolation – it is the one that severs the route to impact.
Stop counting vulnerabilities. Start understanding the paths an attacker would actually take.
Arcseer delivers CREST-accredited, AI-powered penetration testing supervised by certified practitioners – machine-speed testing with human judgement. If you’re rethinking how your testing programme reports risk, we’d be glad to show you what a validated attack path looks like for your environment.