CyCognito advances AI penetration testing beyond just vulnerability assessments as the attack surfaces of enterprises change.

      The cybersecurity sector is facing a new situation: traditional vulnerability management is insufficient. As organizations quickly implement AI-driven applications, autonomous agents, and large language model (LLM) frameworks, security teams are realizing that many of the most critical threats cannot be detected through standard CVE-based scanning alone. Instead, companies increasingly struggle with misconfigured AI services, unsecured machine learning infrastructure, and interconnected systems that create entirely new attack vectors.

      In this context, CyCognito is enhancing its exposure management platform with ongoing AI pentesting capabilities aimed at revealing intricate, contextual risks that deterministic scanners frequently miss. This initiative signifies a broader transition in the industry, in which security leaders are shifting from merely identifying known vulnerabilities to continuously validating how attackers could exploit an organization’s specific environment.

      AI Creates New Blind Spots

      The swift uptake of generative AI has significantly broadened enterprise attack surfaces. Organizations are launching AI copilots, retrieval-augmented generation (RAG) systems, Model Context Protocol (MCP) servers, orchestration platforms, and machine learning infrastructure more quickly than many security programs can track them.

      Unlike typical software vulnerabilities, these systems often create security gaps due to configuration errors, excessive permissions, or unintended exposure between interconnected services. These vulnerabilities may not be assigned a CVE, yet they can grant attackers direct access to sensitive business data.

      According to CyCognito, its platform now recognizes over 60 categories of AI-related technologies, including MCP servers, Ollama, MLflow, PyTorch, Triton, n8n, and other components frequently used in enterprise AI implementations.

      From Detection to Simulated Attacks

      Rather than simply discovering assets, CyCognito’s new capability employs AI agents to simulate how an attacker would navigate through an organization’s exposed infrastructure.

      Instead of inquiring whether a vulnerability exists, the system assesses whether a series of actions could realistically compromise sensitive systems or expose valuable data. These attack chains integrate contextual reasoning, environmental awareness, and multi-step testing that extend far beyond conventional vulnerability scanning.

      The company’s recently released technical deep dive on continuous AI pentesting elucidates how these AI agents prioritize testing using contextual intelligence gathered from an organization’s external attack surface, enabling security teams to concentrate on verified business risks instead of isolated technical findings.

      Real-World Findings Highlight Emerging Risks

      CyCognito disclosed various examples that demonstrate the types of exposures continuous AI pentesting can uncover.

      In one example, an externally accessible MCP server had an unauthenticated natural-language interface linked to a production CRM environment. By executing a series of prompt injections and API interactions, AI agents were able to enumerate backend services and ultimately access millions of customer and financial records without requiring credentials.

      Another engagement revealed a publicly accessible knowledge base supporting a RAG deployment. Although authentication protected the AI agent itself, the underlying document repository remained openly accessible, exposing internal documents, contracts, communications, and customer information.

      Perhaps the most alarming was the discovery of an internet-facing physical security platform responsible for managing building access controls, surveillance cameras, and badge readers. This system was deployed alongside customer-facing AI services without adequate segmentation, demonstrating how digital transformation initiatives can inadvertently increase risk to operational technology.

      None of these examples relied on exploiting an identified software vulnerability. Instead, they stemmed from architectural decisions, deployment practices, and business contexts that conventional scanners would likely miss.

      Why Continuous Testing Matters

      Traditional penetration testing continues to be a crucial security practice, but its point-in-time nature limits its effectiveness against environments that are constantly changing.

      While AI has accelerated offensive testing, many organizations still conduct AI-powered assessments on a periodic basis due to computational costs. According to CyCognito, this often restricts deep testing to only the highest-priority assets, leaving much of the external attack surface largely unexamined.

      To tackle this challenge, the company has developed what it calls the Target Graph™, an orchestration layer that integrates exposure assessment, threat intelligence, deterministic validation, and business context to determine where AI agents should concentrate their computational efforts.

      This method allows AI pentesting to continuously adapt its depth and techniques based on newly discovered assets, environmental changes, and emerging threat activities.

      An additional benefit comes from the system’s feedback loop. Attack methods successfully validated by AI agents can later be converted into deterministic tests, lowering future computational demands while broadening automated coverage.

      A Broader Industry Transition

      The advent of AI-native infrastructure is altering how organizations approach external exposure management. As enterprise environments become increasingly dynamic, security programs are transitioning from merely identifying isolated vulnerabilities to continuously assessing how systems interact and whether those interactions create exploitable pathways.

      CyCognito’s latest announcement reflects this evolution. Instead of treating penetration testing as an occasional validation process, the company envisions continuous AI-driven testing as an ever-present aspect of exposure management.

      Internally referred to as “Project Kineto,” the initiative draws inspiration from the shift from still photography to motion pictures—a metaphor for replacing sporadic security snapshots with ongoing visibility into changing attack surfaces.

      As AI adoption accelerates within enterprises, the industry