<strong>AI in the Hacker's Toolbox: A Useful tool, not a magic button</strong>
Artificial intelligence is everywhere in the headlines, and cybersecurity is no exception. You may have read that AI can now "hack anything" on its own, but the reality is more interesting and a lot less dramatic.
First, who uses these tools? Penetration testers are security professionals hired to test a company's systems, with permission, to find weaknesses before criminals do. Bug bounty hunters do something similar independently and report the flaws they find to companies in exchange for a reward. Red teams go a step further and simulate a real attacks against an organisation(s), testing not only technology but also people and processes. All of them are now using AI in some form in their daily work.
Security testing can be though as a project with several stages. First, the tester sets up the tools and servers needed for the work. Then comes reconnaissance phase, which simply means gathering information about the target. Which systems are visible from the internet, what software they run, who works there, what assets they have, etc...After that comes the phase where tester is looking for weaknesses and trying to exploit them. Finally an actionable report the customer can act on, is written.
AI can speed up almost every stage in security testing. It can write a small program in minutes that would otherwise take an hour or more, sort through thousands of lines of data to spot what stands out, explain unfamiliar code or suggest what to try next. It also helps to turn technical findings into a clear, easily understandable report, which is often one of the most time-consuming parts of the job.
But. AI still makes mistakes and it makes them confidently. It may "find" a vulnerability that does not exist or suggest an attack that would never work. On the other hand, it can also triage existing vulnerability as false-positive and leave it from the findings alltogether. It cannot, with 100 percent accuracy, judge on its own what is safe to try in a customer's live systems. An experienced professional is still needed to guide the AI, check the results, make decisions and take responsibility. AI makes a good tester faster, but it does not turn a beginner into an expert overnight. In overall, while organizations benefit when testers cover more ground with the same time and budget, individual professionals have individual benefits from AI, mostly based on their experience and skillset.
AI *tools* are developing extremely quickly and more and more of the routine work will be automated. AI agents that can carry out several steps on their own are already existing and tested. The role of the human is likely to shift towards guiding the work, checking the results and making the judgement calls. Currently AI is a highly capable *tool*, not some magical button that does everything on its own.
If you want to hear more about how AI is used in real security testing, including what works, what does not and what to expect next, come and listen to my talk at Cyber Security Nordic. See you there!
Jarkko Vesiluoma is Principal Offensive Security Lead at Elisa. He helps organisations identify security weaknesses and strengthen their defences through practical security testing and red team exercises. In his spare time, he conducts security research and hunts for bug bounties, embracing a “breaking to build” mindset to improve security for companies and individuals alike.
