Agentic Al Penetration Testing: Exploring Human-AI Workflows

Cybersecurity organizations face growing pressure to perform more penetration testing due to regulations such as NIS2, while at the same time struggling with a shortage of experienced professionals. In practice, pentesters often spend a lot of time interpreting scan results, prioritizing findings, and drafting reports, usually with support from scarce senior staff.
This project explores whether new forms of AI can help improve these workflows. In particular, it looks at agentic AI systems that can work with existing cybersecurity tools through standards such as the Model Context Protocol (MCP). Rather than focusing only on technical performance, the project studies how AI can be integrated into the daily work of pentesters in a practical and responsible way.
Together with practice partners Netboss BV and Bureau Veritas, The Hague University of Applied Sciences will investigate which pentesting tasks are most suitable for AI support and how AI-supported workflows affect productivity, work satisfaction, and output quality. The project will use realistic pentesting scenarios to compare current ways of working with new AI-supported workflow designs. It will also examine what risks, limitations, verification steps, and effects on senior review time need to be considered when using AI in this professional context. In addition, the project compares current workflows with AI-supported variants to determine whether AI actually reduces total human effort, including correction and rework, rather than merely shifting work between junior and senior staff.
The result of the project will be practical knowledge about how AI can support pentesting work in real organizations. This includes recommendations for workflow design, conditions for responsible use, and lessons for both professional practice and education. In this way, the project aims to help cybersecurity organizations use scarce expertise more effectively while maintaining high-quality work.