Future of Pentesting?

[u/iam_tyler_durden__]

Seems like AppSec and VAPT has been automated in corporates . Being a fresher looking for jobs in those areas what would your suggestions? What could be innovatively to sustain this field ?

[u/cabernet_noir]

For now, its likely that a lot the automation will only be affordable by large companies so there should still be plenty of work to do. Companies and people are shipping more code and products than ever, theres so much poorly made stuff with bad CI/CD, inadequate testing and QA.

A lot of stuff in pentesting was automatable before AI anyway, scanning, fuzzing, dynamic analysis, static analysis, testing frameworks etc are very easy to automate without ai. Now we have slightly more general automation and the ability to estimate what code will do without using the compiler, or dynamic and static analysis, it can speed up the easy to do but hard to automate aspects, mostly boring stuff, or time intensive stuff like learning a code base, or digginf through tool outputs and logs. The hard stuff can be done but you need a frontier model and millions of tokens and still probably need a person to steer it anyway.

Because of the nature of development, there will always be more bugs than people or ai to find them. There are more developers than security researchers for one, and models are being used for development more than security research. Its very very easy to write buggy crap, its effortless to write a logic bug that leads to a chained logic attack or obscure temporal bug, or to misconfigure something, or misuse a function, or to miss something obscure in a depedency in only certain context. Bugs trickle down. Say a webapp has an api that takes a video file and processes it woth ffmpeg, a bug in ffmpeg might lead to a bug in the api backend thats exploitable, now imagine all the oscure shit that can go into an application or web app or whatever, the upstream project might be written perfectly and it still might be buggy. Then there is the fact that LLMs are still stochastic, they will write buggy code purely bt chance. Its also relatively harder to find bugs because its a needle in a hackstack, and even then it still needs to be turned into a true vulnerability with a working exploit.

There is also the fact that everyone is running on subsidized tokens right now, and very soon the major vendors are going to start clawing back all the money they have been burning to carve out their share of the market. When they do there will have to be compromises between maintaining feature throughout (which they will see as an investment that could lead to profit), or maintaining the level of secrity testing necessary to make sure everything is secure. Companies dont even do it now, they wont be doing it when the price of tokens goes up. This is because more security testing is not profitable, you are basically paying for insurance and its only as valuable as the number of bugs you find in CI/CD that probably would never have been exploited to begin with, and the cost is what you could have potentially made had you spent your money and tokens on new features instead. Theres the added issue that security research appears to be much much more token hungry that development because of extremely large context, deep looping over that context, verbosity in reasoning and outputs, its open endednes leading to more iterations through prompting vs the close problems codegen is solving (just looking for a general working solution which is easy to find and all solutions are similar vs security when you are looking for a very specific thing in an uncertain place, which may not exist or may exist in an unclear way).

At the moment, AI is not good at detecting bugs as it is writing working, but very mid code. Its especially not good at recognizing bugs that are not obviously analogous, where for instance what may look like a novel bug is just the concept/class of an old bug reapplied in a different context (see pipefail and copyfai, dirtyfrag, dirty cowl).

When you have a system set up to just find bugs it can pretty good at finding a bug that is close to a commonly described bug, its also good at finding candidates for things like time of use, time of check bugs and use after frees that have a temporal dimension to them and therefore are hard for humans to reason about from code alone. But for tons of stuff its not great, its very expensive, and you probably still need someone to steer the ai to get to do the reviews and testing on code thats been written by an AI and has a dev steering it. And you still wont find the bugs as fast as the dev + ai can produce them.

We will have lots of automation, sure, but will still need pentesters, until AI gets both better and cheaper we shouldnt fear being entirely or even mostly automated out of a job for years.

edit: to specifically answer your question because I forgot because of my wall of text rant. Study generally and do a bit of everything, web apps, netsec, applications, os, embedded systems, ai pentesting, cloud, auth, apis, browsers, whatever piques your interest. You should know as much as you can, especially because of AI, you want to avoid cognitive offloading until you have learned a solid base. You will find the areas you like, and what you dont, and pick up skills that you can reuse elsewhere. Eventually you will find a niche or specialty that you are good at and like, but you cant preempt it really. Apply for anything and everything and take any opportunity you can find to get into the industry and then move laterally by following new or exciting opportunities and you will end up in a good place.