AI penetration testing cannot replace independent cybersecurity assurance

Take that as a policy question, not as an indication that AI penetration testing will become a federal requirement.

A penetration test is not in any way a complete analysis of how CUI is protected.

Cost is the other reason why policymakers should be wary of treating automated testing as a simple drop in.

You’ve got reconnaissance, you’ve got exploit attempts, you’ve got evidence analysis, you’ve got reporting and you’ve got the need to validate everything repeatedly.

A requirement to test continuously would turn what might have been a one-off assessment cost into a perpetual operating cost.