AI agents can help organise repetitive security-testing work, but they do not create permission to test a system. The foundation of any red-team workflow is a written scope, agreed rules of engagement, and a clear owner who can stop the exercise.

A computer screen with cybersecurity code
The important production feature is not raw agent speed; it is the scope boundary, tool controls, evidence review, and audit trail.

Define the Engagement Before the Agent

Record authorised domains, IP ranges, applications, accounts, test windows, excluded systems, rate limits, prohibited techniques, emergency contacts, and evidence-handling rules. The agent should not be able to expand its own scope based on discovered links, DNS records, or model-generated assumptions.

Separate Planning, Tool Execution, and Review

A controlled architecture can separate a planner that proposes tasks, narrow tool adapters that execute approved checks, and a reviewer that validates the output. Every action should be checked against scope immediately before execution. Tool results—not model narration—must be the source of evidence for a finding.

Make Safe Defaults Enforceable

Use read-only checks where possible, conservative request rates, isolated test environments, explicit approval for intrusive actions, and a kill switch controlled by the engagement lead. Do not store credentials in prompts or logs. Redact secrets and personal data from evidence before it is shared.

Require Reproducible Findings

A report should include the affected asset, timestamp, tool and version, exact request or command where appropriate, supporting output, impact, reproduction steps, and remediation guidance. An AI-generated claim without a reproducible artefact should remain an unverified lead, not a confirmed vulnerability.

Use Established Testing Guidance

NIST SP 800-115 provides guidance for planning and conducting technical information-security assessments. The OWASP Web Security Testing Guide offers a structured reference for web application testing. These resources are useful baselines, but the engagement's written authorisation and rules of engagement remain controlling.

AI can accelerate preparation and evidence handling. The security professional remains responsible for permission, judgement, validation, communication, and the decision to stop.

Sources and further reading