The Human Touch in Cybersecurity: Why AI Can't Fully Replace Penetration Testers

The enduring need for human expertise and creativity.

The rise of automated penetration testing tools and services marks a real shift in how we approach cybersecurity. These tools scour networks and systems for vulnerabilities at a level of efficiency and scale that was previously unthinkable. But the deeper we go, the clearer one truth becomes: automation, powerful as it is, cannot replace the human element of penetration testing.

Today’s networks are vast interconnected webs: huge numbers of devices, diverse subnets, and a blend of modern and legacy systems spanning multiple operating systems and software. Think of it as an incredibly complicated jigsaw puzzle featuring servers and all their routers, switches, firewalls, web applications, databases, IoT devices, and cloud services. A Bayesian diagram representing such a network would be of astronomical proportions.

This complexity might be likened to the myriad of variations of games on a chess board, after 4 moves by each player there are 288 Billion possible combinations (More on chess here) but even this comparison has its limitations. Unlike chess, which operates on an 8×8 grid with set rules and a finite number of pieces, modern technical environments resemble vast, multidimensional chess boards. Each cell can have different initial states and rules, and the network is in a constant state of flux. This network is continuously changing – devices are added or removed, software is updated, configurations are altered, and user behaviors shift. It’s like a chess game where the rules, pieces, and board shape keep changing mid-game, but the objective of checkmating the opponent remains the same.

In a game of chess, after 4 moves by each player there are 288 Billion possible combinations – this is nothing compared to the complexity of a typical organizations network.

The human interaction factor further adds a layer of unpredictability to this equation. Each login, each opened email, each downloaded file, each web browsing session alters the state of the network, often in ways that are unforeseeable. The multitude of devices and software, coupled with constant, unpredictable human engagement, create a level of complexity that automation struggles to comprehensively tackle.

While automation effectively tests common default configurations, it struggles when faced with the sheer diversity and peculiarities of real-world network setups. The vast array of possible configurations, including custom setups, legacy systems, and non-standard technologies, lie beyond its reach.

The human element, a mix of errors, habits, and unpredictability, also stays out of automation’s reach. For example, an absent network administrator’s lax security practices or a manager’s penchant for using the same password across platforms can’t be accounted for by automated systems.

Advanced persistent threats (APTs) and zero-day vulnerabilities also present a significant challenge. Designed to evade common security tools, APT tactics such as custom malware, phishing for initial access, and stealthy network movement often slip under the radar of systems relying on known vulnerabilities and techniques.

AI-based Penetration Testing

Artificial intelligence and automation, for all their advancements, cannot mimic the intuition, creativity, and expertise of human penetration testers. The ability to join the dots into an attack path, or the creative insight to explore network compromise via nearby WiFi access, is a uniquely human trait that automation, no matter how advanced, won’t capture any time soon.

Automation is also a double-edged sword. The same tools that defenders use to try to identify vulnerabilities can also be utilized by attackers to find potential targets and infiltration points in an automated fashion (Read about wormGPT here). Adversaries are already incorporating automation like vulnerability scanners and exploit kits into their arsenal. If defenders become over-reliant on automated penetration testing, they leave themselves vulnerable to attackers who are doing the same thing.

As we embrace the promise of automation, let’s not overlook the value of the human touch in cybersecurity. In a landscape of near-infinite initial states, continuous change, and human unpredictability, human penetration testers are still an essential part of the puzzle, offering their unique skills where automation can only attempt to follow.

Humans and AI working together

Automation is undoubtedly a complementary tool, and one that will undoubtedly improve security in many areas, but human penetration testers remain the key players in this chess game – They find complicated issues like this.

Our Incenter platform combines both automation and humans to deliver the best penetration testing available. Contact us to find out more.