{"id":2743,"date":"2026-08-02T06:00:24","date_gmt":"2026-08-02T13:00:24","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2743"},"modified":"2026-08-02T06:31:21","modified_gmt":"2026-08-02T13:31:21","slug":"the-anatomy-of-a-pentest-where-does-ai-change-the-game","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/","title":{"rendered":"The Anatomy of a Pentest: Where Does AI Change the Game?"},"content":{"rendered":"\n

Two weeks ago I sat in on a webinar<\/a> where CyCognito’s founders walked through continuous AI pentesting. The framing stayed with me: the pentest itself has not changed, only who runs each part of it.<\/p>\n\n\n\n

AI has reached nearly every corner of cybersecurity, and pentesting is no exception. The promise is an agent that probes applications, uncovers flaws scanners miss, and delivers a report before a human tester has finished scoping the engagement. It lands because most enterprises still pentest an application once or twice a year, even though their attack surface changes every day.<\/p>\n\n\n\n

So rather than ask whether AI can pentest, this piece asks a more practical question: how does AI change the process, phase by phase, and where does it do something that was not possible before?<\/p>\n\n\n\n

Breaking Down Pentest Workflows<\/strong><\/h2>\n\n\n\n

Pentesting is one of the oldest practices in cybersecurity, and its structure has barely moved in fifty years. James P. Anderson sketched the foundations in a 1972 study for the US Air Force. NIST formalized four phases in SP 800-115 in 2008. PTES expanded the process to seven in 2011.<\/p>\n\n\n\n

For simplicity, this piece uses five phases:<\/p>\n\n\n\n

    \n
  1. Discovery and scoping<\/li>\n\n\n\n
  2. Recon and enumerate<\/li>\n\n\n\n
  3. Test for security weaknesses<\/li>\n\n\n\n
  4. Exploit what can be exploited<\/li>\n\n\n\n
  5. Report, validate, and learn<\/li>\n<\/ol>\n\n\n\n

    That arc has been remarkably stable. Who performs each part of it has not. In the 1970s, security teams worked every phase by hand. Then scanners began absorbing pieces of the process: SATAN in 1995, Nmap in 1997, Nessus in 1998, Metasploit in 2003. Each generation of tooling moved another slice of the work from people to machines, and the phases stayed where they were.<\/p>\n\n\n\n

    LLM agents are the next entry in that sequence. Not a new discipline, a new executor in an old process.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    What separates this executor from the ones before it is that it is metered. <\/p>\n\n\n\n

    A scanner costs roughly the same whether it runs against ten assets or ten thousand. A model charges by the token, and running all five phases through one can climb into thousands of dollars per asset. At that price, coverage shrinks back to a small number of targets, recreating the very gap AI pentesting was supposed to close.<\/p>\n\n\n\n

    So the question at each phase is not only whether a model can do the work. It is whether the work needs one. Keep that in mind as we walk through the anatomy of a pentest.<\/p>\n\n\n\n

    1. Discovery and Scoping<\/strong><\/h2>\n\n\n\n

    Every pentest starts with two questions: what do we have, and what do we test?<\/p>\n\n\n\n

    Discovery answers the first. For fifty years the map of what an organization actually exposes has been assembled by hand, so it is only ever as complete as the person drawing it. Most organizations know their crown jewels.<\/p>\n\n\n\n

    Two things break that model. The asset that leads to a breach is often not a crown jewel, and it is often one nobody knew was there at all: an API left behind after a migration, a staging environment that was never decommissioned, an MCP server wired to production data and exposed without authentication. They never make it onto the map because no one knows they exist.<\/p>\n\n\n\n

    Scoping answers the second question. Once you know what is out there, something has to decide what deserves the time and budget of a test this cycle, and at what depth. Do that by hand and you fall back on the same short list of familiar systems, which is how the rest of the surface stays untested year after year.<\/p>\n\n\n\n

    Mapping a full attack surface and re-prioritizing it every cycle is work almost nobody can perform manually. That is where the coverage gap begins, before a single test has run. It is also the phase that needs the least reasoning to fix. Enumerate, attribute, rank. The work is mechanical and it scales, which is why the size of the scope should never be the thing a testing program is limited by.<\/p>\n\n\n\n

    2. Recon and Enumerate<\/strong><\/h2>\n\n\n\n

    Before testing anything, a pentester maps the target: live hosts, open services, software versions, endpoints, and technologies.<\/p>\n\n\n\n

    The tools used here are not new. Human testers and AI pentesting platforms alike rely on scanners such as masscan, httpx, subfinder, and Nmap. They are fast, proven, and built to run at scale. What differs is how the work is orchestrated.<\/p>\n\n\n\n

    One approach is a deterministic workflow. Nmap discovers open services, its output feeds the next appropriate check, that result feeds the one after it. No model has to reason through each step, because the pipeline is fixed and the logic is known.<\/p>\n\n\n\n

    The other puts a model in the loop for the orchestration itself. The agent is handed a terminal function whose argument is a raw shell command, plus a prompt listing which scanners to run and which flags to pass. Every sweep becomes a separate completion, and the agent reads each tool’s output back through the model to choose the next command. A single run can spend hundreds of calls this way, with the transcript summarized to stay under the context limit.<\/p>\n\n\n\n

    Both approaches produce the same map at very different cost. Running the scanners themselves costs a few cents per asset either way. Wrapping a model around them, so that every command and every block of output is another completion, adds token costs that push the total toward a dollar or more per asset. That is one to two orders of magnitude more for an identical result.<\/p>\n\n\n\n

    Recon is the clearest case in the whole process where the work is known, repeatable, and gains nothing from judgment.<\/p>\n\n\n\n

    3. Security Testing<\/strong><\/h2>\n\n\n\n

    Once the asset is mapped, the next step is to test the basics: known CVEs, exposed services, default and weak credentials, broken authentication and session handling, common misconfigurations, and familiar web vulnerabilities.<\/p>\n\n\n\n

    Here too, everyone is drawing from the same toolbox: Nuclei, Nikto, ZAP. And as in recon, there is no need for a model to orchestrate these checks. They are known, repeatable, and easy to sequence deterministically. Run them broadly, collect the results, and establish what can already be found without expensive reasoning.<\/p>\n\n\n\n

    AI becomes valuable once that foundation is in place. That is when the work stops following a predefined checklist. A model can investigate an unusual response, adapt its approach, connect findings across different parts of the application, and explore attack paths no scanner was explicitly programmed to follow.<\/p>\n\n\n\n

    4. Exploitation<\/strong><\/h2>\n\n\n\n

    Exploitation is where the economics change, because it is the phase that produces proof.<\/p>\n\n\n\n

    Everything before it describes potential: a version that looks vulnerable, an endpoint that looks exposed, a credential that might work. Exploitation is where you find out.<\/p>\n\n\n\n

    The goal is definitive evidence that a weakness is real and reachable, evidence that goes beyond an early finding. You get there by acting on the target: sending an actual payload, forging a token, injecting a prompt into an exposed AI interface, deploying a web shell, running a command and capturing the output.<\/p>\n\n\n\n

    Consider an application that leaks its production signing key in response to an anonymous request. A skilled tester recognizes what that key unlocks. Forge a valid token, impersonate any user, then bypass authorization to read every tenant’s documents, and in some cases write and delete them too.<\/p>\n\n\n\n

    No single scanner alert describes that chain. Finding it requires experimentation: form a hypothesis, send a request, interpret the response, adjust, and continue. The path may be different on every target.<\/p>\n\n\n\n

    This is the part of pentesting that has traditionally depended on human creativity, and it is often slow and expensive for exactly that reason. A skilled tester may spend days on a single application. It is also the one phase where a model’s cost buys something no scanner can produce at any price.<\/p>\n\n\n\n

    It is also the phase that demands the most care, because exploitation is not a simulation. A forged token really authenticates. A web shell really executes. The same property that makes the evidence trustworthy makes the phase risky, since it runs against live production systems. Real exploitation has to stay inside a clear boundary: scoped approvals, techniques that prove access without corrupting data or disrupting availability, and a hard line before anything destructive.<\/p>\n\n\n\n

    5. Report and Learn<\/strong><\/h2>\n\n\n\n

    A pentest is only useful if the team can trust the finding and act on it.<\/p>\n\n\n\n

    Proof comes first, and it is the same proof gathered during exploitation: the exact requests and responses, the forged token, the command that ran and the output it returned, and clear steps to reproduce the chain. Much of that validation can be done deterministically, without a model asserting anything.<\/p>\n\n\n\n

    A model can then turn that evidence into a clear report, explain the attack path and its business impact, and write remediation for the people who have to fix it. Because the finding is backed by a reproduced chain rather than an inferred CVE, the remediation can point at the exact link that made the attack possible: which signing key to rotate, which endpoint to put behind authentication, which authorization check was missing. That is guidance a team can act on the same day, not a generic severity score to triage later.<\/p>\n\n\n\n

    Five Phases, One Underlying Question<\/strong><\/h2>\n\n\n\n

    The anatomy of the pentest has not changed. There is still a scope, a discovery process, a testing layer, an exploitation phase, and a report. What has changed is the range of machines capable of performing parts of that work.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Read across the five phases and the pattern is consistent. Discovery, recon, and baseline testing are mechanical problems that automation already handles at scale. <\/p>\n\n\n\n

    Reporting is a writing problem, and models write well once the evidence underneath them is solid. Exploitation is the phase that has resisted automation for fifty years, and it is the one where reasoning changes what is possible.<\/p>\n\n\n\n

    Spend a model across every phase and you may produce an impressive result on a handful of assets. Use deterministic systems for the work they already perform well, then apply AI where creativity and adaptation matter, and the same budget can cover orders of magnitude more.<\/p>\n\n\n\n

    The payoff is coverage, meaning testing broad enough and cheap enough to reach the assets that have always been left out.<\/p>\n\n\n\n

    So it is worth asking, of your own program and of anyone who tests on your behalf:<\/p>\n\n\n\n

    If I have 20,000 or 50,000 exposed assets, how many of them will you test, how often will you test them, and what will it cost?<\/p>\n\n\n\n

    And while pondering that, please consider that for some enterprises these numbers can go into six or even seven figures.<\/p>\n\n\n\n

    Want to learn more? Catch the full webinar here.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Running a pentest through an AI model can cost a few cents per asset or a few thousand dollars, depending entirely on which phase you spend it on. In this post I provide a quick walkthrough of all five phases.<\/p>\n","protected":false},"author":45,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2743","post","type-post","status-publish","format-standard","hentry","category-perspectives"],"yoast_head":"\nThe Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog\" \/>\n<meta property=\"og:description\" content=\"Running a pentest through an AI model can cost a few cents per asset or a few thousand dollars, depending entirely on which phase you spend it on. In this post I provide a quick walkthrough of all five phases.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\" \/>\n<meta property=\"og:site_name\" content=\"CyCognito Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-02T13:00:24+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-02T13:31:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png\" \/>\n\t<meta property=\"og:image:width\" content=\"3600\" \/>\n\t<meta property=\"og:image:height\" content=\"1509\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jenny Salem\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jenny Salem\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\"},\"author\":{\"name\":\"Jenny Salem\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/0fc71a7e26c302d90e5a4973bc7f0c52\"},\"headline\":\"The Anatomy of a Pentest: Where Does AI Change the Game?\",\"datePublished\":\"2026-08-02T13:00:24+00:00\",\"dateModified\":\"2026-08-02T13:31:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\"},\"wordCount\":1772,\"publisher\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes-1280x537.png\",\"articleSection\":[\"Perspectives\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\",\"url\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\",\"name\":\"The Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes-1280x537.png\",\"datePublished\":\"2026-08-02T13:00:24+00:00\",\"dateModified\":\"2026-08-02T13:31:21+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage\",\"url\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png\",\"contentUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png\",\"width\":3600,\"height\":1509},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.cycognito.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Anatomy of a Pentest: Where Does AI Change the Game?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#website\",\"url\":\"https:\/\/www.cycognito.com\/blog\/\",\"name\":\"Cycognito Blog\",\"description\":\"Research, Product News and Latest Updates\",\"publisher\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.cycognito.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#organization\",\"name\":\"Cycognito\",\"url\":\"https:\/\/www.cycognito.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png\",\"contentUrl\":\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png\",\"width\":1720,\"height\":550,\"caption\":\"Cycognito\"},\"image\":{\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/0fc71a7e26c302d90e5a4973bc7f0c52\",\"name\":\"Jenny Salem\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d6a7f5fec425eddd0d48087f3ccd753d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d6a7f5fec425eddd0d48087f3ccd753d?s=96&d=mm&r=g\",\"caption\":\"Jenny Salem\"},\"description\":\"Product Marketing\",\"url\":\"https:\/\/www.cycognito.com\/blog\/author\/jenny-salem\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/","og_locale":"en_US","og_type":"article","og_title":"The Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog","og_description":"Running a pentest through an AI model can cost a few cents per asset or a few thousand dollars, depending entirely on which phase you spend it on. In this post I provide a quick walkthrough of all five phases.","og_url":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/","og_site_name":"CyCognito Blog","article_published_time":"2026-08-02T13:00:24+00:00","article_modified_time":"2026-08-02T13:31:21+00:00","og_image":[{"width":3600,"height":1509,"url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png","type":"image\/png"}],"author":"Jenny Salem","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jenny Salem","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#article","isPartOf":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/"},"author":{"name":"Jenny Salem","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/0fc71a7e26c302d90e5a4973bc7f0c52"},"headline":"The Anatomy of a Pentest: Where Does AI Change the Game?","datePublished":"2026-08-02T13:00:24+00:00","dateModified":"2026-08-02T13:31:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/"},"wordCount":1772,"publisher":{"@id":"https:\/\/www.cycognito.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes-1280x537.png","articleSection":["Perspectives"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/","url":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/","name":"The Anatomy of a Pentest: Where Does AI Change the Game? | CyCognito Blog","isPartOf":{"@id":"https:\/\/www.cycognito.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes-1280x537.png","datePublished":"2026-08-02T13:00:24+00:00","dateModified":"2026-08-02T13:31:21+00:00","breadcrumb":{"@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#primaryimage","url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png","contentUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/anatomy-who-executes.png","width":3600,"height":1509},{"@type":"BreadcrumbList","@id":"https:\/\/www.cycognito.com\/blog\/the-anatomy-of-a-pentest-where-does-ai-change-the-game\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cycognito.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The Anatomy of a Pentest: Where Does AI Change the Game?"}]},{"@type":"WebSite","@id":"https:\/\/www.cycognito.com\/blog\/#website","url":"https:\/\/www.cycognito.com\/blog\/","name":"Cycognito Blog","description":"Research, Product News and Latest Updates","publisher":{"@id":"https:\/\/www.cycognito.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cycognito.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.cycognito.com\/blog\/#organization","name":"Cycognito","url":"https:\/\/www.cycognito.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png","contentUrl":"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/logo-1720x550-1.png","width":1720,"height":550,"caption":"Cycognito"},"image":{"@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/0fc71a7e26c302d90e5a4973bc7f0c52","name":"Jenny Salem","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cycognito.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d6a7f5fec425eddd0d48087f3ccd753d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d6a7f5fec425eddd0d48087f3ccd753d?s=96&d=mm&r=g","caption":"Jenny Salem"},"description":"Product Marketing","url":"https:\/\/www.cycognito.com\/blog\/author\/jenny-salem\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/comments?post=2743"}],"version-history":[{"count":4,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2743\/revisions"}],"predecessor-version":[{"id":2777,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/posts\/2743\/revisions\/2777"}],"wp:attachment":[{"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/media?parent=2743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/categories?post=2743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cycognito.com\/blog\/wp-json\/wp\/v2\/tags?post=2743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}