As AI systems gain the ability to exploit vulnerabilities and follow attack paths, human oversight must remain more than a ceremonial checkpoint.
There is a meaningful difference between asking artificial intelligence to identify a vulnerability and authorizing it to exploit one.
The first is an extension of what automated security tools have done for years. The second gives software permission to behave like an attacker—probing systems, chaining weaknesses, escalating privileges, and potentially moving laterally through a production environment.
That may be exactly what makes autonomous penetration testing valuable.
It is also what makes guardrails essential.
Security teams have good reasons to want more automation in offensive security. Traditional penetration tests provide valuable insights, but they are typically performed at set intervals. Meanwhile, applications change, infrastructure evolves, new assets appear, configurations drift, and attackers continue looking for ways in.
Autonomous pentesting promises to narrow that gap. It can test more frequently, revisit previously identified weaknesses, validate remediation efforts, and explore potential attack paths without waiting for another manually scheduled engagement.
But speed and persistence are not substitutes for control.
Autonomy Changes the Risk Equation
A vulnerability scanner generally observes and reports. An autonomous pentesting system may take action.
That distinction should shape how organizations evaluate these platforms.
Even a well-intentioned action can disrupt a service, alter data, trigger defensive systems, expose sensitive information, or move beyond the boundaries an organization intended to test. The more capable an autonomous system becomes, the more important it is to define where that capability ends.
The question is not simply whether an AI system can imitate some of the work performed by an experienced penetration tester.
The more consequential question is whether it can do so within an authorized scope, under understandable rules, with meaningful human authority over sensitive actions.
BreachLock founder and CEO Seemant Sehgal said this concern repeatedly surfaced during the development of the company’s newly introduced Breach360 autonomous penetration testing solution.
“In the more than fifty CISO conversations that shaped Breach360’s vision, one thing became clear: the industry is ready to embrace autonomous pen testing, but not at the expense of control,” Sehgal said. “Human-in-the-loop kept coming up as a non-negotiable.”
That may prove to be one of the defining principles of autonomous offensive security.
Human-in-the-Loop Must Mean Something
“Human-in-the-loop” is becoming a familiar assurance in discussions about agentic AI. But the phrase can mean very different things.
A person receiving a report after an autonomous system has completed its work technically places a human somewhere in the process. It does not necessarily give that person meaningful control.
For autonomous pentesting, human involvement must begin before testing starts and continue throughout the engagement.
Security teams should be able to define which assets are in scope, what techniques may be used, how aggressively testing should proceed, and which actions require separate approval. They should also be able to observe what the system is doing and stop it immediately if its behavior creates unexpected risk.
The most important controls should not depend on the AI system deciding for itself that it has gone too far.
Scope Must Be Explicit
Every penetration test requires a clear scope. Autonomous testing does not change that requirement; it makes technical enforcement of the scope more important.
Authorized targets should be identified precisely. Depending on the engagement, that might include specified IP addresses, domains, hostnames, applications, APIs, or network segments.
The platform must then remain within those boundaries.
This is particularly important for organizations with interconnected infrastructure, shared cloud environments, third-party services, or systems belonging to customers and business partners. Discovering that another asset is reachable does not necessarily mean the testing system is authorized to interact with it.
BreachLock says Breach360 tests only explicitly authorized assets and allows organizations to control the scope and intensity of each engagement. The platform can also require approval before taking actions such as lateral movement or privilege escalation.
Those are not merely administrative conveniences. They are foundational safety controls.
Sensitive Actions Need Approval Gates
Autonomous testing is most valuable when it goes beyond identifying isolated vulnerabilities to determine whether weaknesses can be combined into a viable attack path.
That is also where risk increases.
An AI system may discover that compromised credentials provide access to another host, that a misconfiguration permits privilege escalation, or that one exploited system can serve as a foothold into a more sensitive environment.
Allowing the system to continue could yield valuable evidence of the organization’s actual exposure. It could also affect systems far beyond the initial point of entry.
Approval gates give human operators a deliberate decision point. The system can explain the action it proposes, the reason for taking it, and the likely consequences. An authorized person can then permit or deny the next step.
Breach360 incorporates approvals for exploitation and lateral movement, according to BreachLock. It also provides guardrails and a kill switch that allow operators to stop an engagement.
This model preserves some of the speed and investigative capability of autonomous testing while reserving consequential decisions for human operators.
Visibility Is Part of Control
A kill switch is useful only if someone recognizes when to use it.
Security teams therefore need visibility into what an autonomous pentesting platform is doing—not merely a summary generated when the test is over.
Operators should be able to see which techniques are being attempted, which systems are being contacted, what evidence has been collected, how discovered weaknesses are being connected, and why the system recommends its next action.
This transparency serves several purposes.
It helps teams identify unintended behavior. It provides evidence that testing remained within scope. It also allows defenders to understand how an attack path developed and where existing security controls succeeded or failed.
Breach360 provides real-time attack-path visibility and maps testing activity to MITRE ATT&CK techniques. BreachLock says users can follow an engagement through reconnaissance, enumeration, exploitation, and lateral movement, with approval required before proceeding with specified sensitive actions.
That level of visibility can also make autonomous testing more useful to defenders. The objective is not simply to watch an AI compromise a system. It is to identify where the attack could have been interrupted.
Proof Must Be Paired With Restraint
One of the persistent problems in vulnerability management is that a long list of findings does not necessarily tell a security team what to fix first.
A severe vulnerability may be unreachable in a particular environment. Several individually less dramatic weaknesses may form a practical path to a critical asset. Without context, remediation teams can spend substantial time addressing findings that look dangerous on paper while more consequential attack paths remain open.
Autonomous pentesting can help by establishing whether a vulnerability is reachable and exploitable. It can also show how multiple weaknesses might be chained together.
Breach360 is designed to document proof of exploitability, distinguish exploitable findings from weaknesses that are technically valid but not operationally exploitable, and prioritize remediation according to attacker logic rather than vulnerability scores alone. BreachLock says the system draws on intelligence from more than 40,000 real-world penetration testing engagements.
That experience may help an autonomous system recognize meaningful patterns. It does not eliminate the need for careful operating boundaries.
In offensive security, the ability to prove a vulnerability must always be balanced against the potential impact of doing so.
Human Experts Still Have a Role
Autonomous pentesting is sometimes presented as an alternative to traditional, human-led testing. In practice, the more useful model may be a combination of the two.
Automation can provide frequency, consistency, rapid retesting, and scale. Human pentesters contribute creativity, context, skepticism, accountability, and an understanding of business consequences that may not be apparent from technical evidence alone.
A human expert can also challenge an autonomous system’s conclusions.
Was the reported attack path genuinely viable? Did the system overlook a compensating control? Would exploitation have the same consequences in normal operating conditions? Does the proposed remediation address the underlying risk, or merely interrupt one tested route?
Breach360 allows customers to add a certified BreachLock pentester to review findings and recommendations. The solution is also part of the BreachLock Unified Platform, which brings together attack surface management, autonomous penetration testing, and expert-led Penetration Testing as a Service.
That integration reflects an important idea: autonomous and human-led testing do not have to be competing approaches.
One can extend the reach of the other.
Safe Does Not Mean Risk-Free
No form of active security testing is entirely free of risk.
A human pentester can make a mistake. A carefully written script can behave unexpectedly. A production system can respond differently than anticipated. Autonomous testing adds another layer of uncertainty because the system may determine its next steps dynamically rather than following a completely predetermined sequence.
The goal of guardrails is not to pretend that these risks no longer exist.
It is to make them visible, bounded, interruptible, and subject to human authority.
As autonomous pentesting matures, organizations should judge platforms by more than the number of vulnerabilities they can find or the speed at which they can operate. They should examine how scope is enforced, when approval is required, what operators can observe, how testing can be stopped, how findings are validated, and whether qualified experts remain available when judgment is needed.
The future of penetration testing will likely include more autonomy. The changing attack surface and the need for more frequent validation make it difficult to avoid.
But autonomous should never mean unaccountable.
The safest and most useful systems will not be those that remove people from offensive security altogether. They will be those that let machines operate at speed while ensuring humans retain control over how far they can go.
Additional Resources
Video Overview
Infographic
Steven Bowcut is the Editor-in-Chief of Brilliance Security Magazine and host of the BSM Podcast. He has spent years covering cybersecurity and physical security, focusing on the technologies, strategies, and leadership insights that matter most to security practitioners and decision-makers. Through the magazine and podcast, Steven brings readers and listeners practical content with industry leaders, innovators, and experts shaping the future of security. Follow and connect with Steve on Instagram and LinkedIn.