CyCognito Brings Always-On AI Pentesting to External Attack Surface Management

2026-07-22 · Source: CIO · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning · Depth: Intermediate, short

Summary

CyCognito has launched Continuous AI Pentesting, a new capability integrated into its exposure management platform. This AI-driven offensive pentesting service continuously assesses external attack surfaces, addressing the limitations of traditional periodic engagements. The solution aims to counter the rising threat from AI-powered attacks, which enable low-skilled individuals to execute sophisticated campaigns rapidly and affordably. CyCognito's architecture centers on a "Target Graph" that connects the AI pentesting solution with three core modules: Exposure Assessment, Exposure Validation (running over 100,000 deterministic tests), and Threat Intelligence. This integrated approach provides rich context and exploitability evidence, enhancing the efficiency of AI pentesting agents across the often-overlooked 99% of assets beyond the top 1% priority. The system, internally called Project Kineto, also self-evolves by hardcoding new risk scenarios into Exposure Validation.

Key takeaway

For Directors of AI/ML or Security Engineers managing external attack surfaces, the rise of AI-powered attacks necessitates continuous, comprehensive security validation. You should evaluate solutions that integrate AI pentesting across your entire asset footprint, not just high-priority targets. This approach helps you proactively identify and remediate vulnerabilities like exposed CRMs or RAG indexes before low-skilled attackers exploit them, ensuring your defenses keep pace with evolving threats.

Key insights

AI-driven continuous pentesting scales security validation across the entire external attack surface, countering evolving AI-powered threats.

Principles

• Integrate AI pentesting with rich asset context.
• Automate deterministic tests to free AI agents.
• Continuously evolve security validation with new findings.

Method

CyCognito's architecture uses a Target Graph to bridge AI pentesting with Exposure Assessment, Exposure Validation (100,000+ tests), and Threat Intelligence, providing context for efficient agent runs and self-evolving capabilities.

In practice

• Identify unauthenticated access to production CRMs.
• Discover publicly readable RAG indexes with sensitive data.
• Expose internet-facing building access controls.

Topics

• AI Pentesting
• External Attack Surface Management
• Exposure Management
• Threat Intelligence
• Vulnerability Management
• Security Automation

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, Security Engineer, Director of AI/ML

Related on AIssential

• Continuous Offensive Security: The Line We've Been Walking — AI-driven offensive security is crucial for continuous defense against autonomous attackers and new AI-specific attack surfaces.
• Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents — AI agent security benefits from reconnaissance-driven pentesting to uncover exploitable weaknesses for stronger attacks.
• AI fraud is exploding. Here’s the countermove. — AI-driven document fraud necessitates AI-enhanced forensic analysis for effective detection and prevention.
• vxcontrol / pentagi — PentAGI automates comprehensive penetration testing using AI agents, sandboxed tools, and a knowledge graph.
• How a Penetration Test Builds Customer Trust & Strengthens ISO 42001 Certification — AI-powered attacks and agentic frameworks create novel, adaptive security risks that demand specialized penetration testing beyond traditional audits.
• AI Threat Readiness Pillar 1: Reduce Critical Exposures & Scan with AI — AI accelerates exploitation, demanding a shift from vulnerability volume to critical exposure reduction.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by CIO.