Most AI pentesting solutions sidesteps the question by starting from a list the customer provides. To me, that misses a fundamental question: how do you decide what deserves testing in the first place? I wanted us to start from the attack surface itself. <\/p>\n\n\n\n
That’s why we built CyCognito\u2019s Target Graph\u2122, our target selection engine for AI pentesting. It turns evidence about your attack surface into a plan: which assets to investigate, where to start and how deeply to test.<\/p>\n\n\n\n
We designed the Target Graph\u2122 around five principles.<\/p>\n\n\n\n
1. Consider the entire external attack surface<\/strong><\/h3>\n\n\n\nOur first requirement was that the Target Graph\u2122 consider the entire external attack surface, including (and perhaps particularly) assets outside the usual pentest shortlist.<\/p>\n\n\n\n
That meant drawing on external attack surface management (EASM) discovery to understand which assets exist, their technologies and the relationships and dependencies between them.<\/p>\n\n\n\n
The point is to start with what is actually exposed, rather than limiting AI pentesting to assets the organization already knows about and has classified as important.<\/p>\n\n\n\n
2. Bring the context together<\/strong><\/h3>\n\n\n\nKnowing an asset exists is the starting point. Deciding whether it deserves deeper investigation requires understanding what it is, what it does and how it relates to the rest of the organization.<\/p>\n\n\n\n
This is where the depth of CyCognito\u2019s EASM becomes particularly important.<\/p>\n\n\n\n
Over nearly a decade, we’ve built discovery and contextualization capabilities that go well beyond identifying IP addresses, domains and technologies. CyCognito maps the organization’s business structure, including subsidiaries, acquisitions and business units, and attributes discovered assets to the entities that own them. It also identifies business functions, technologies, exposed services and potential relationships between systems.<\/p>\n\n\n\n
Threat intelligence adds another dimension, identifying emerging vulnerabilities and attack techniques that may be relevant to the asset.<\/p>\n\n\n\n
The Target Graph\u2122 draws on these layers of context to identify assets whose importance might otherwise be missed.<\/p>\n\n\n\n
3. Use deterministic testing before spending AI resources<\/strong><\/h3>\n\n\n\nNot every security question requires burning AI tokens.<\/p>\n\n\n\n
CyCognito already performs over 100,000 deterministic security tests across the external attack surface. It covers known vulnerabilities, application security weaknesses, misconfigurations, authentication issues, data exposure and other risk scenarios.<\/p>\n\n\n\n
These tests are repeatable, scalable and considerably less expensive than deep AI-driven investigation. And because they’re part of the same platform as EASM discovery, their results are already connected to the assets and their context.<\/p>\n\n\n\n
The Target Graph\u2122 can use this evidence to inform target selection, without spending AI resources rediscovering weaknesses that deterministic tests can already identify.<\/p>\n\n\n\n
Importantly, deterministic testing results are one of several inputs into the decision. An application with no known weaknesses can still be a strong candidate because of the data it handles, the functionality it exposes or its connections to other systems.<\/p>\n\n\n\n
4. Build diversity into the plan<\/strong><\/h3>\n\n\n\nWe wanted each additional target to add meaningful testing coverage.<\/p>\n\n\n\n
An organization may run several deployments of the same application, each with similar technology and functionality. Testing all of them in depth could mean covering much of the same ground.<\/p>\n\n\n\n
The Target Graph\u2122 recognizes those similarities and can select representative deployments, leaving room to investigate different applications, technologies and business functions.<\/p>\n\n\n\n
Each choice therefore depends on what is already in the plan. A target might rank highly on its own, but if a similar system is already selected, testing an application with a different business role or exposed interface could add more coverage.<\/p>\n\n\n
\n![\"\"](\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/target-diversity_2.gif\")
High-scoring vs. diversified pentest plan<\/em><\/figcaption><\/figure>\n<\/div>\n\n\nThe balance between breadth and depth is configurable. Organizations can choose how much to diversify their testing, depending on their priorities.<\/p>\n\n\n\n
But selecting one representative doesn’t mean ignoring the others. What we find in one deployment can change what we test next. If AI pentesting uncovers a weakness in a representative application, related deployments become candidates for targeted follow-up. Instead of spending resources testing every similar asset from scratch, we can use the findings to guide further investigation.<\/p>\n\n\n\n
5. Rebuild the plan each cycle<\/strong><\/h3>\n\n\n\n
Knowing an asset exists is the starting point. Deciding whether it deserves deeper investigation requires understanding what it is, what it does and how it relates to the rest of the organization.<\/p>\n\n\n\n
This is where the depth of CyCognito\u2019s EASM becomes particularly important.<\/p>\n\n\n\n
Over nearly a decade, we’ve built discovery and contextualization capabilities that go well beyond identifying IP addresses, domains and technologies. CyCognito maps the organization’s business structure, including subsidiaries, acquisitions and business units, and attributes discovered assets to the entities that own them. It also identifies business functions, technologies, exposed services and potential relationships between systems.<\/p>\n\n\n\n
Threat intelligence adds another dimension, identifying emerging vulnerabilities and attack techniques that may be relevant to the asset.<\/p>\n\n\n\n
The Target Graph\u2122 draws on these layers of context to identify assets whose importance might otherwise be missed.<\/p>\n\n\n\n
3. Use deterministic testing before spending AI resources<\/strong><\/h3>\n\n\n\nNot every security question requires burning AI tokens.<\/p>\n\n\n\n
CyCognito already performs over 100,000 deterministic security tests across the external attack surface. It covers known vulnerabilities, application security weaknesses, misconfigurations, authentication issues, data exposure and other risk scenarios.<\/p>\n\n\n\n
These tests are repeatable, scalable and considerably less expensive than deep AI-driven investigation. And because they’re part of the same platform as EASM discovery, their results are already connected to the assets and their context.<\/p>\n\n\n\n
The Target Graph\u2122 can use this evidence to inform target selection, without spending AI resources rediscovering weaknesses that deterministic tests can already identify.<\/p>\n\n\n\n
Importantly, deterministic testing results are one of several inputs into the decision. An application with no known weaknesses can still be a strong candidate because of the data it handles, the functionality it exposes or its connections to other systems.<\/p>\n\n\n\n
4. Build diversity into the plan<\/strong><\/h3>\n\n\n\nWe wanted each additional target to add meaningful testing coverage.<\/p>\n\n\n\n
An organization may run several deployments of the same application, each with similar technology and functionality. Testing all of them in depth could mean covering much of the same ground.<\/p>\n\n\n\n
The Target Graph\u2122 recognizes those similarities and can select representative deployments, leaving room to investigate different applications, technologies and business functions.<\/p>\n\n\n\n
Each choice therefore depends on what is already in the plan. A target might rank highly on its own, but if a similar system is already selected, testing an application with a different business role or exposed interface could add more coverage.<\/p>\n\n\n
\nHigh-scoring vs. diversified pentest plan<\/em><\/figcaption><\/figure>\n<\/div>\n\n\nThe balance between breadth and depth is configurable. Organizations can choose how much to diversify their testing, depending on their priorities.<\/p>\n\n\n\n
But selecting one representative doesn’t mean ignoring the others. What we find in one deployment can change what we test next. If AI pentesting uncovers a weakness in a representative application, related deployments become candidates for targeted follow-up. Instead of spending resources testing every similar asset from scratch, we can use the findings to guide further investigation.<\/p>\n\n\n\n
5. Rebuild the plan each cycle<\/strong><\/h3>\n\n\n\n
We wanted each additional target to add meaningful testing coverage.<\/p>\n\n\n\n
An organization may run several deployments of the same application, each with similar technology and functionality. Testing all of them in depth could mean covering much of the same ground.<\/p>\n\n\n\n
The Target Graph\u2122 recognizes those similarities and can select representative deployments, leaving room to investigate different applications, technologies and business functions.<\/p>\n\n\n\n
Each choice therefore depends on what is already in the plan. A target might rank highly on its own, but if a similar system is already selected, testing an application with a different business role or exposed interface could add more coverage.<\/p>\n\n\n
The balance between breadth and depth is configurable. Organizations can choose how much to diversify their testing, depending on their priorities.<\/p>\n\n\n\n
But selecting one representative doesn’t mean ignoring the others. What we find in one deployment can change what we test next. If AI pentesting uncovers a weakness in a representative application, related deployments become candidates for targeted follow-up. Instead of spending resources testing every similar asset from scratch, we can use the findings to guide further investigation.<\/p>\n\n\n\n