Tag: penetration-testing
-
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer’s production website, on its own. One login request let the user choose where the…
-
ARTEX AI, Claude agents used in cyberattacks on South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
-
AI-Driven tool ARTEX used in attacks against South Korean Banks
CrowdStrike analyzes open directories left by an attacker who used the ARTEX AI pentest tool and LLMs to breach South Korean financial firms. CrowdStrike published a research on a campaign against South Korean financial organizations that ran from late September to early October 2026 and ended with stolen data. The attacker left their working notes…
-
WorkNest Secure Achieves CREST STAR-FS Accreditation for Red Teaming
WorkNest Secure has achieved CREST Simulated Targeted Attack & Response for Financial Services (STAR-FS) accreditation, recognising its ability to deliver intelligence-led red teaming assessments for organisations operating in high-risk and regulated environments. The accreditation confirms that WorkNest Secure meets CREST’s standards for conducting threat-led penetration testing, using realistic attack scenarios to assess how effectively organisations…
-
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Tags: ai, attack, crowdstrike, cybersecurity, data, finance, intelligence, penetration-testing, theft, threat, toolCybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration.”In this activity, the threat actor leveraged…
-
Chinese Hacker Deployed AI in Campaign Against South Korean Banks
CrowdStrike revealed that a Chinese-speaking hacker deployed agentic pentesting tool ARTEX and Claude to help breach data from South Korean financial firms First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/
-
Financially Motivated Hacker Uses Agentic AI to Breach Multiple South Korean Finance Targets
Tags: ai, breach, china, cyber, data-breach, finance, hacker, infrastructure, open-source, penetration-testing, toolA financially motivated campaign that used agentic AI tools to breach South Korean financial organizations and exfiltrate data. Active from late September to early October 2026, the operation combined ARTEX, an open-source penetration testing platform developed in China, with multiple large language models. Researchers recovered exposed operational files that documented the attacker’s infrastructure, prompts, and…
-
South Korea Suspects AI Tool Helped Steal Bank Customer Data
Attack Servers Show Signs Open-Source Penetration Testing Tool Artex Employed. Police in South Korea probing data breaches at multiple banks have found signs on attack servers that the threat actor used a free, open-source and semi-automated penetration testing tool called Artex AI to help steal data pertaining to more than 60,000 individuals. First seen on…
-
What Is Agentic Pentesting? What It Proves, and Where It Stops.
If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, validates, and exploits attack paths autonomously, the way a real attacker would.That promise is worth taking seriously. It’s also worth pressure testing, and three questions do the heavy lifting.…
-
Continuous Penetration Testing: Why Annual Pen Tests Are a Compliance Checkbox, Not a Security Strategy
An annual penetration test reliably satisfies an audit requirement but tells you comparatively little about your actual exposure for the other eleven months of the year. This piece covers what an annual test does and does not actually evidence, why the compliance framing caps what testing programs aim for, and what changes operationally once an…
-
Pentest versus Vulnerability Scan – TeleTrusT veröffentlicht Leitfaden für Penetrationstests
First seen on security-insider.de Jump to article: www.security-insider.de/teletrust-handreichung-penetrationstests-planen-vergeben-a-63ecbebd6ddf59fc06c7e8f502019cf4/
-
Pentest versus Vulnerability Scan – TeleTrusT veröffentlicht Leitfaden für Penetrationstests
First seen on security-insider.de Jump to article: www.security-insider.de/teletrust-handreichung-penetrationstests-planen-vergeben-a-63ecbebd6ddf59fc06c7e8f502019cf4/
-
Horizon3 und CrowdStrike verbinden Pentest-Ergebnisse mit SIEM-Telemetrie
Horizon3 integriert NodeZero in CrowdStrike Falcon Next-Gen SIEM. Validierte Angriffspfade lassen sich so mit SOC-Telemetrie korrelieren und priorisieren. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/horizon3-und-crowdstrike-verbinden-pentest-ergebnisse-mit-siem-telemetrie/a46432/
-
How Pentest Companies Adapt In The Era of AI
Every penetration testing firm is facing the same pressure right now. AI tools are faster, cheaper, andincreasingly capable, and testers are using them whether the company has a policy on it or not. There’s ahigh change AI has already entered your workflow the question is whether it has entered on your terms oryour employee’s personal…
-
AI Is Redefining Threat-Led Penetration Testing
Crest CEO Nick Benson on Governance, Ethics and AI-Driven Pen Testing Risk. Artificial intelligence is reshaping penetration testing, expanding both its capabilities and risks. Crest CEO Nick Benson says financial institutions need stronger governance, ethical guardrails and tightly controlled threat-led testing to keep pace with AI-driven change. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-redefining-threat-led-penetration-testing-a-32851
-
CISO’s Expert Guide to Agentic Pentesting for Websites
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production.TL;DRExploitation is now the front door.…
-
Code Audit vs. Penetration Test vs. Technical Due Diligence: Which Review Is Worth Paying For?
Your developers say the application is ready. Your automated security scans show no critical findings. An AI coding assistant has reviewed the code. Then an enterprise customer asks for a penetration test. An investor requests technical due diligence. Another consultant… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/code-audit-vs-penetration-test-vs-technical-due-diligence-which-review-is-worth-paying-for/
-
Pentest bestanden und trotzdem gehackt: Wo Red Teaming und APT Simulationen mehr bieten
Die Firma hat den Pentest bestanden, wurde aber trotzdem gehackt? Erfahre, warum Red Teaming und APT-Simulationen die IT-Abwehr verbessern. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/gast-artikel/pentest-bestanden-und-trotzdem-gehackt-wo-red-teaming-und-apt-simulationen-mehr-bieten-333471.html
-
What Zero-Day Response Should Be in the Post-Mythos Era
AI is shrinking the time between vulnerability disclosure and exploitation, leaving defenders less time to wait for patches or public exploits. Picus Security explains how exploitability validation, security control testing, and autonomous pentesting can help teams close exposure gaps before attackers arrive. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/what-zero-day-response-should-be-in-the-post-mythos-era/
-
Attacking AI: Penetration Testing AI Systems
AI is rife in the current digital landscape; both business and pleasure have been infiltrated by AI agents, LLMs, and chatbots. Absolutely no one can escape it. The rate of adoption of AI as a new digital tool is the… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/attacking-ai-penetration-testing-ai-systems/
-
What is API Penetration Testing?
If your business uses any app or third-party integration, then chances are it’s held together by APIs. APIs, in a nutshell, are the invisible connections that allow your systems to talk to one another by transferring data. They have become… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-is-api-penetration-testing/
-
Can You Fail a Pentest? What SaaS Startups Should Know
Key TakeawaysCan you fail a pentest is the wrong question, a penetration test produces a findings report, not a pass or fail grade, and this holds true for SaaS and HealthTech startups alike.Critical findings are common, not rare, most first… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/can-you-fail-a-pentest-what-saas-startups-should-know/
-
What an external penetration test is and how one is actually run
Exploiting a vulnerability has been the most common way attackers break in for six years running, 32% of intrusions in 2025 (Mandiant’s M-Trends 2026), and those flaws sit on your internet-facing perimeter, the surface an external penetration test covers. A… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/what-an-external-penetration-test-is-and-how-one-is-actually-run/
-
How a Penetration Test Is Conducted
Modern cyber attacks are not a question of if they happen, but when; to mitigate business disruption, the most proactive organisations already use professional penetration testing as part of their security defences. Penetration testing is the practice of hiring an… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/how-a-penetration-test-is-conducted/
-
How a Penetration Test Is Conducted
Modern cyber attacks are not a question of if they happen, but when; to mitigate business disruption, the most proactive organisations already use professional penetration testing as part of their security defences. Penetration testing is the practice of hiring an… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/how-a-penetration-test-is-conducted/
-
How a Penetration Test Is Conducted
Modern cyber attacks are not a question of if they happen, but when; to mitigate business disruption, the most proactive organisations already use professional penetration testing as part of their security defences. Penetration testing is the practice of hiring an… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/how-a-penetration-test-is-conducted/
-
How to build a continuous pentesting program
IntroductionAn unpatched flaw is now the most common entry point for a breach, at 31%, ahead of stolen credentials at 13%, and the median time to fix one has crept up to 43 days (Verizon’s 2026 DBIR). So an annual… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/how-to-build-a-continuous-pentesting-program/
-
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation. Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across…
-
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Boston, MA, USA, 8th September 2026, CyberNewswire First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/reflectiz-launches-agentic-pentesting-for-websites-up-to-10x-coverage-vs-conventional-pentests/
-
Bug Bounty vs Penetration Testing: What the Data Shows
Key TakeawaysHackerOne’s own data shows the average pentest surfaces 12 vulnerabilities with 16 percent rated high or critical, while bug bounty programs average a higher 25 percent high or critical rate.Pentests tend to surface more systemic and architectural issues, like… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/bug-bounty-vs-penetration-testing-what-the-data-shows/