When planning a pentest, the list usually starts with the crown jewels: the applications and data stores you’ve classified as most critical. But a large external attack surface can contain thousands of assets. Some can expose sensitive data or provide access to critical systems, even if they’ve never made it onto your pentest shortlist.
AI makes it possible to investigate more of that surface, but each investigation consumes compute and tokens. You still have a testing budget, and choosing where to spend it determines how much ground you can cover.
Most AI pentesting solutions sidesteps the question by starting from a list the customer provides. To me, that misses a fundamental question: how do you decide what deserves testing in the first place? I wanted us to start from the attack surface itself.
That’s why we built CyCognito’s Target Graphâ„¢, our target selection engine for AI pentesting. It turns evidence about your attack surface into a plan: which assets to investigate, where to start and how deeply to test.
We designed the Target Graphâ„¢ around five principles.
1. Consider the entire external attack surface
Our first requirement was that the Target Graphâ„¢ consider the entire external attack surface, including (and perhaps particularly) assets outside the usual pentest shortlist.
That meant drawing on external attack surface management (EASM) discovery to understand which assets exist, their technologies and the relationships and dependencies between them.
The point is to start with what is actually exposed, rather than limiting AI pentesting to assets the organization already knows about and has classified as important.
2. Bring the context together
Knowing an asset exists is the starting point. Deciding whether it deserves deeper investigation requires understanding what it is, what it does and how it relates to the rest of the organization.
This is where the depth of CyCognito’s EASM becomes particularly important.
Over nearly a decade, we’ve built discovery and contextualization capabilities that go well beyond identifying IP addresses, domains and technologies. CyCognito maps the organization’s business structure, including subsidiaries, acquisitions and business units, and attributes discovered assets to the entities that own them. It also identifies business functions, technologies, exposed services and potential relationships between systems.
Threat intelligence adds another dimension, identifying emerging vulnerabilities and attack techniques that may be relevant to the asset.
The Target Graphâ„¢ draws on these layers of context to identify assets whose importance might otherwise be missed.
3. Use deterministic testing before spending AI resources
Not every security question requires burning AI tokens.
CyCognito already performs over 100,000 deterministic security tests across the external attack surface. It covers known vulnerabilities, application security weaknesses, misconfigurations, authentication issues, data exposure and other risk scenarios.
These tests are repeatable, scalable and considerably less expensive than deep AI-driven investigation. And because they’re part of the same platform as EASM discovery, their results are already connected to the assets and their context.
The Target Graphâ„¢ can use this evidence to inform target selection, without spending AI resources rediscovering weaknesses that deterministic tests can already identify.
Importantly, deterministic testing results are one of several inputs into the decision. An application with no known weaknesses can still be a strong candidate because of the data it handles, the functionality it exposes or its connections to other systems.
4. Build diversity into the plan
We wanted each additional target to add meaningful testing coverage.
An organization may run several deployments of the same application, each with similar technology and functionality. Testing all of them in depth could mean covering much of the same ground.
The Target Graphâ„¢ recognizes those similarities and can select representative deployments, leaving room to investigate different applications, technologies and business functions.
Each choice therefore depends on what is already in the plan. A target might rank highly on its own, but if a similar system is already selected, testing an application with a different business role or exposed interface could add more coverage.
The balance between breadth and depth is configurable. Organizations can choose how much to diversify their testing, depending on their priorities.
But selecting one representative doesn’t mean ignoring the others. What we find in one deployment can change what we test next. If AI pentesting uncovers a weakness in a representative application, related deployments become candidates for targeted follow-up. Instead of spending resources testing every similar asset from scratch, we can use the findings to guide further investigation.
5. Rebuild the plan each cycle
The attack surface changes all the time. New applications appear, configurations change and existing services expose new functionality. With AI-assisted development and vibe coding making it easier to build and deploy software, the pace of change is only increasing.
Change itself is a useful signal. A newly deployed application, a modified authentication flow or a newly exposed API may deserve pentesting even if the asset was previously considered low risk.
That requires two things: an up-to-date view of the attack surface and a target selection process inexpensive enough to run frequently.
CyCognito’s continuously updated discovery and deterministic testing provide the foundation. The Target Graphâ„¢ uses fresh evidence, including changes to assets, new security findings and emerging threats, to reconsider which targets deserve attention. The goal is to minimize the time between a meaningful change to the attack surface and the decision to investigate it.
The plan isn’t a black box
The five principles above determine how the Target Graphâ„¢ builds its testing plan. But security teams also need to understand the decisions behind it.
If the Target Graphâ„¢ recommends an unfamiliar service, you should be able to see what drove the recommendation and what testing it would add to the plan.
A system might be selected because it exposes sensitive functionality, because threat intelligence points to a relevant attack technique or because it adds coverage not represented by other targets. Another might be deferred because a similar deployment is already being investigated.
These explanations are grounded in the evidence used to make each decision, giving security teams a way to assess recommendations, challenge assumptions and understand where their testing resources are going.
Put more of your attack surface to the test
Your crown jewels should absolutely be pentested. But they represent only a small fraction of your external attack surface. Beyond them are thousands of applications, services and infrastructure assets that can expose sensitive data or provide a route into critical assets.
We designed the Target Graphâ„¢ to make that broader coverage practical. It turns evidence from across the attack surface into a focused testing plan, with a clear reason for each target selected.
Ready to look beyond the usual pentest shortlist? Book a demo to see how CyCognito puts these principles into practice.
