Building an AI Pentester: What It Takes to Match a Human Tester
Rogier Fischer, CEO and co-founder of Hadrian, breaks down what separates a good pentest from a vulnerability scan: judgement, creativity, context, common sense and persistence. Large language models do not bring all of these on their own. Ask one to pentest an application and it will run a few checks and declare itself done. Getting real results means building a framework around the model.
Rogier walks through how Hadrian builds that framework. A planner agent, running on the most capable models, turns business context and reconnaissance into thousands of hypotheses and hands them to around 25 classes of specialised exploit agents, often hundreds running in parallel. Every attacking action passes through hardcoded and prompt based guardrails that Hadrian calls the leash, and every finding goes through a separate validation step and a human reviewer. The result is a pentest that takes two to three days instead of weeks, with a full record of what was tested and found safe, not only what was found broken.
In this talk, you will learn:
- Why business logic flaws, not technical vulnerabilities, make up the majority of AI pentest findings, and why that is where AI moves the needle most.
- How a planner agent, specialised exploit agents and the leash give AI the common sense of a human tester, from reusing login sessions to never clicking the big red delete button.
- Which human strengths models already bring, which still need engineering and training, and why security is becoming a continuous cycle now that AI agents can act as threat actors themselves.