Penetration Testing

Penetration Testing | News, how-tos, features, reviews, and videos

AI cyberattackers are getting better faster

Move over, Moore’s law: The difficulty of the cybersecurity defenses AI models can crack is doubling every four months or so — and that time interval is shrinking.

By John E. Dunn

May 18, 20265 mins

Artificial IntelligenceSecuritySecurity Practices

Articles

Putting AI-assisted ‘vibe hacking’ to the test

Valuable tools for experienced attackers and researchers, LLMs are not yet capable of creating exploits at a prompt, researchers found in a test of 50 AI models — some of which are getting better quickly.

By Lucian Constantin

Jul 14, 2025 7 mins

CyberattacksSecurity PracticesVulnerabilities

Generative AI is making pen-test vulnerability remediation much worse

Organizations already struggle to fix flaws discovered during penetration testing. Gen AI apps bring added complexity and the need for greater expertise.

By John Leyden

Apr 22, 2025 6 mins

Patch Management SoftwareSecurity PracticesThreat and Vulnerability Management

Top 16 OffSec, pen-testing, and ethical hacking certifications

These certs offer hands-on training and up-to-date curricula, equipping offensive security professionals with their choice of specialized or broad skill credentialing.

By Eric Frank

Apr 10, 2025 16 mins

CertificationsIT Skills and TrainingSecurity Practices

Generative AI red teaming: Tips and techniques for putting LLMs to the test

Getting started with a generative AI red team or adapting an existing one to the new technology is a complex process that OWASP helps unpack with its latest guide.

By Chris Hughes

Mar 13, 2025 8 mins

HackingSecurity PracticesThreat and Vulnerability Management

CISA cybersecurity workforce faces cuts amid shifting US strategy

CISA red teams have been dismantled as federal cybersecurity funding faces deep cuts.

By Gyana Swain

Mar 12, 2025 6 mins

SecuritySecurity Practices

Gen AI is transforming vulnerability hunting for pen-testers and attackers alike

Large language models (LLMs) are proving to be valuable tools for discovering zero-days, bypassing detection, and writing exploit code, thereby lowering the barrier to entry for penetration testers — and the cybercriminals they hope to keep a step ahead of.

By Lucian Constantin

Jan 7, 2025 15 mins

Generative AISecurity PracticesThreat and Vulnerability Management

Download our breach and attack simulation (BAS) buyer’s guide

Breach and attack simulation (BAS) products help organizations understand their security posture by automating the tests of specific threat vectors. You can think of BAS as like going around to check whether all the locks on your doors work.

By Maria Korolov

Dec 18, 2024 1 min

CyberattacksData BreachSecurity Practices

Weaponized pen testers are becoming a new hacker staple

Popular security tools are getting abused in growing attacks as miscreants move to non-technical and brute-forcing methods.

By Shweta Sharma

Nov 20, 2024 4 mins

MalwareSecuritySecurity Practices

How AI is becoming a powerful tool for offensive cybersecurity practitioners

From vulnerability assessments to penetration testing, AI and large language models are profoundly changing the fundamentals of offsec.

By John P. Mello Jr.

Oct 17, 2024 8 mins

SecuritySecurity PracticesThreat and Vulnerability Management

14 underrated pentesting tools to round out your red team arsenal

With plenty of pentesting tools out there you must know how they work and which fits the use case you are interested in testing. CSO selected 14 underrated tools and what they are best for.

By Maril Vernon

Oct 2, 2024 16 mins

Cloud SecuritySecurity PracticesThreat and Vulnerability Management

Europol disrupts about 600 abusive Cobalt Strike servers

The coordinated operation took down 593 IP addresses, which were flagged for abuse of the legitimate pen-testing software.

By Shweta Sharma

Jul 4, 2024 3 mins

HackingSecurity Practices

Continuous red-teaming is your only AI risk defense

The sheer volume of new and unknown threats coming our way — as well as the lack of fully formed risk frameworks for AI — means that red-team continuous monitoring is not only essential but perhaps your only path to security.

By David Gee

Jun 26, 2024 7 mins

Data and Information SecurityRisk ManagementSecurity Practices

View all

AI cyberattackers are getting better faster

Pen tests show AI security flaws far more severe than legacy software bugs

I replaced manual pen tests with automation. Here’s what I learned.

When AI safety constrains defenders more than attackers

The hard part of purple teaming starts after detection

Offensive security takes center stage in the AI era

Why you should purple team your SOC

7 reasons the SOC is in crisis — and 5 steps to fix it

How AI red teams find hidden flaws before attackers do