Practical Automation of Penetration Testing with Agentic AI
summary
Claims a production-ready agentic AI orchestration that runs a planner, executor, analyst and guardian over an N8N pipeline to automate end-to-end pentests. Evaluated on a 33‑task PenBench web subset and reproduced AD labs: it reliably completes SQLi enumeration and credential discovery, fully automates shared‑folder and GPP cpassword chains, but struggles with directory traversal payload crafting and fails full NTLM relay automation due to shell concurrency limits. Reporting outputs HTML reports via JSON webhooks.
AI-written summary · about
chapters (25)
- 0:00Agentic AI in penetration testing
- 1:10Speaker background and motivation
- 3:01Penetration testing challenges
- 5:53AI in automated pentesting
- 9:51Research foundation
- 12:01Agentic AI definition
- 13:46Research goals and framework
- 14:29Agentic AI architecture
- 15:51Role of n8n
- 18:00Schema-driven context
- 19:53Analyst agent and RAG
- 20:59Guardian agent safety
- 22:03Agentic pentesting workflow
- 23:27CTF experiments
- 26:40Report generation
- 27:44Real-world pentesting
- 30:34Active Directory escalation
- 33:21Automated lab environments
- 34:26Scenario: Shared folder exposure
- 36:57Scenario: GPP password issue
- 38:23Scenario: NTLM relay abuse
- 40:51Key findings
- 41:57Future directions
- 42:40MCP integration demo
- 44:06Q&A
related talks
26mChallenging the Boundaries of Pentesting — The Age of AI
27mKeynote: Towards Building Safe and Secure Agentic AI
19mKeynote: Towards Building Safe and Secure Agentic AI
56mAttacking AI
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
42mSecuring AI Agents...
48mSecuring Agentic AI
47mAgentic Testing: Your Skilled Human Tester