AI-assisted Pentest with Erebus Strike – Intelligent Analysis

What sets SySS’s AI-Assisted penetration test apart?

In our AI-assisted penetration test using Erebus Strike, agent-based automation and human IT security expertise work closely together. Our consultants provide the agent with technical knowledge, best practices, and project-specific parameters. An orchestrator coordinates specialized sub-agents, processes their feedback, and uses it to determine the next steps in the testing process.

This approach integrates multiple levels:

• The consultant defines the procedure, requirements, and scope of the test.
• The agent processes technical information and makes further testing decisions based on it.
• All activities can be traced via executed commands, parameters, and logs.

The penetration test thus remains technically controlled and embedded in the respective project context. This is important because language models do not automatically take business logic, risk tolerance, or internal architectural decisions into account. We therefore combine the analytical capabilities of AI with the experience of our consultants.

How does AI enhance penetration testing analysis?

AI can process technical information at high speed, thereby opening up additional perspectives for security analysis. A penetration test benefits particularly when extensive datasets, source code, or complex interrelationships are incorporated into the assessment. The agent can derive hypotheses from this data and identify security-relevant structures for further investigation.

Possible analysis capabilities include:

• Examining large volumes of source code and identifying technical relationships
• Developing attack hypotheses based on the available information
• Investigating security-relevant code paths, such as authentication routines or input processing
• In-depth analysis of potential vulnerabilities and resulting attack paths
• Testing numerous different endpoints as well as various types of access methods

AI-assisted penetration testing is particularly well-suited for web applications and other software-driven systems. Software analysis, reverse engineering, and firmware analysis can also benefit from these capabilities.

1. Define the Scope and Test Context

At the outset, our consultants will coordinate with you to determine the scope of the test and the relevant framework conditions. The test environment, user roles, and specific requirements are then incorporated into the agent’s configuration.

3. Check and Verify Vulnerabilities

Potential vulnerabilities are technically investigated and verified multiple times depending on their criticality. Refuted findings are discarded, while confirmed findings are documented with traceable reproduction steps.

2. Analyze Discovery and Attack Paths

The agent then gains an overview of the application and its attack surface. In the AI-assisted penetration test, the agent evaluates feedback from specialized subagents and plans further testing steps based on that information.

4. Evaluate and Report Findings from a Technical Perspective

Our IT security consultants review the confirmed findings once again within the context of the respective project. They assess their actual relevance and compile reliable findings into a quality-assured report with appropriate recommendations for action.

What information is needed for an AI-assisted penetration test?

The agent requires reliable information about the test subject and the exact application context. In addition to the organizational framework, technical documentation can further support the analysis. Source code is particularly valuable, as large codebases can be evaluated quickly and used to generate additional attack hypotheses.

Depending on the project, you can provide the following information, among other things:

• Source code and technical application documentation
• API documentation with relevant endpoints and functions
• Existing penetration test reports or architectural documentation
• Threat models and information on project-specific risks
• Access credentials for different user roles

Specific areas of focus can also be addressed, such as new features or areas that have not yet been examined. Our consultants will work with you in advance to determine which documents will provide technical value for your AI-assisted penetration test with Erebus Strike.

Models and Back-Ends Suitable for AI-assisted Penetration Testing

In AI-assisted penetration testing, the technical foundation can be adapted to different project requirements. We can draw on various models and back-ends for this purpose. The selection is influenced, among other factors, by the required performance level and the requirements for processing the project data. 

Depending on the specific conditions, various options are available:

• Open-weight models on our own SySS infrastructure in Tübingen
• Larger models via data centers within the European Union
• Third-party providers such as Anthropic or OpenAI
• Different models for individual phases of the testing process

It is not necessary to use the same model throughout an entire project. For example, discovery and verification may place different demands on the respective back end. Additionally, you can configure how frequently a test run should be performed.

Network Penetration Test

A well-secured network determines how far an attacker can get in the event of an incident. A network penetration test analyzes your LAN infrastructure – including segmentation, services, and trust relationships – and provides you with a clear prioritization of necessary measures.

Hardware Penetration Testing

In the field of embedded security, we test embedded systems for security vulnerabilities across multiple technical levels. The analysis can cover hardware and firmware as well as communication interfaces and connected back-end systems.

OT Penetration Test

Where production and IT converge, attack vectors emerge that traditional tests fail to detect. An OT penetration test comprehensively assesses control and production environments and reveals how attackers can move through networked components to reach critical processes.

Penetration Testing of AI Systems

Penetration testing of AI systems focuses on the security of your AI application itself. Among other things, we examine model-specific attack vectors and potential information leaks, as well as the security mechanisms of relevant interfaces.

Since 1998, SySS has been synonymous with professional penetration testing and IT security expertise in the DACH region. Our consultants operate in a vendor-neutral manner and benefit from close collaboration with our in-house R&D department. Established quality processes and recognized certifications provide a reliable framework for high-quality security assessments.

With an AI-assisted penetration test using Erebus Strike, you can expand your security analysis to include modern analytical capabilities embedded within a professionally guided testing process. Our IT experts tailor the approach to your test subject, interpret the results, and help you derive robust next steps for your IT security.