Penetration Testing in the Age of AI: What SMEs Need to Know 

Pen Testing in the Age of AI

Over the last 12 months, we’ve seen a noticeable shift in how organisations approach cybersecurity testing.

Businesses that may once have viewed penetration testing as an occasional compliance exercise are increasingly treating it as a more important part of their security strategy.

The catalyst isn’t simply a new regulation or framework, it’s the rapid acceleration of AI-enabled cyber threats. AI can accelerate activities such as reconnaissance, phishing, vulnerability discovery and attack planning. For attackers, that potentially means assessing more organisations and identifying opportunities faster.

At the same time, exploiting existing vulnerabilities remains a very real route into organisations. The Verizon 2025 Data Breach Investigations report found that exploitation of vulnerabilities as an initial access vector increased by 34% year-on-year, accounting for 20% of breaches. Ransomware appeared in 44% of breaches, while the DBIR reported ransomware involvement in 88% of breaches among SMBs.

How AI Is Scaling the Cyber Threat

We know that AI is lowering the barrier to entry for sophisticated cyberattacks, but what receives less attention is how this happens in practice. Tools and techniques that once required substantial coding expertise are becoming more accessible to less-skilled attackers.

Generative AI can reduce the effort involved in producing and adapting scripts, malicious macros and elements of exploit code. It can also help threat actors interpret technical information, analyse exposed systems and identify potential attack paths.

AI can support the analysis of large volumes of source code and vulnerability information, helping skilled operators identify potential logic flaws or previously unknown weaknesses more efficiently. That doesn’t mean an attacker can reliably generate a working zero-day vulnerability on demand, but AI can accelerate parts of the vulnerability research and analysis process that previously required considerable manual effort.

The UK National Cyber Security Centre’s assessment of AI and the cyber threat concludes that AI will almost certainly make elements of cyber intrusion operations more effective and efficient. It also expects the proliferation of AI-enabled tools to expand intrusion capabilities across a wider range of state and non-state actors. [NCSC report]

AI hasn’t suddenly created an entirely new set of security weaknesses. Exposed services, weak authentication, vulnerable applications, excessive privileges and security misconfigurations have existed for years. What has changed is the speed and scale at which those weaknesses can be identified, analysed and potentially exploited.

Ransomware-as-a-Service Has Already Changed the Model

The scaling of cybercrime didn’t begin with generative AI. The growth of Ransomware-as-a-Service, or RaaS, has enabled threat actors to access established ransomware tooling and supporting infrastructure without building an entire operation themselves. AI can introduce another layer of efficiency, particularly during reconnaissance, target profiling and social engineering.

AI-assisted reconnaissance can help attackers analyse exposed infrastructure and identify systems or information that may hold greater value during an extortion campaign. This reduces some of the manual effort traditionally required to map an organisation and prioritise potential targets.

The significance for SMEs is clear. Attackers don’t necessarily need to select an individual organisation and investigate it manually from the outset. Internet-connected systems can be discovered and assessed at scale for exposed services, unpatched vulnerabilities, weak credentials and configuration issues.

The Time to Exploit Is Shrinking

The Time to Exploit, or TTE, describes the window between a vulnerability being identified or disclosed and attackers attempting to exploit it.

This window is already narrowing. The NCSC reports that the time between vulnerability disclosure and exploitation has shrunk to days and assesses that AI will almost certainly reduce it further.

AI-assisted tools can accelerate elements of this process. Network perimeters can be scanned, external attack surfaces mapped and potential entry points assessed with less manual effort.

Malicious scripts can also be generated and iterated more quickly, helping attackers adjust their approach when a particular technique is detected or blocked.

The same principle applies to social engineering. Generative AI does more than improve spelling and grammar. It allows attackers to produce polished, context-aware phishing messages in multiple languages. Numerous variations can be adapted to different roles, organisations and business scenarios, removing some of the traditional warning signs associated with generic phishing templates.

Voice synthesis and visual deepfakes extend the risk further. In one widely reported case, a Hong Kong-based finance employee transferred approximately US$25.6 million after joining a video conference in which deepfake technology was used to impersonate the organisation’s CFO and other colleagues. [Source: cfo.com]

The practical issue isn’t that every attack is now fully autonomous. It’s that threat actors can perform more activity, more quickly, while reducing some of the expertise and manual effort previously required.

What Is Pen Testing and Why Is It Important?

Penetration testing is an authorised, controlled simulation of cyberattack techniques designed to identify and validate weaknesses before they can be exploited maliciously.

Professional pen testing services go beyond identifying potential vulnerabilities. They explore whether a weakness can be exploited, whether separate weaknesses can be combined, and what an attacker might achieve after gaining an initial foothold.

That helps answer more meaningful questions:

• What can an attacker see from the internet?
• Are public IP addresses exposing unnecessary services?
• Can known vulnerabilities actually be exploited?
• Could a compromised identity provide access to critical systems?
• Can an attacker escalate privileges or move laterally?
• Are SIEM, EDR and SOAR controls generating the expected alerts and responses?
• Where should remediation be prioritised?

This is an important extension of traditional penetration testing. A test shouldn’t only establish whether a vulnerability can be exploited. Where it falls within the agreed scope, it can also help determine whether the organisation’s security stack recognises the activity, whether alerts reach the appropriate team and whether the intended response is initiated.

Penetration Testing vs Vulnerability Scanning 

Vulnerability scanning identifies potential security weaknesses, typically using automated tools. Penetration testing goes further by validating whether vulnerabilities can actually be exploited and what an attacker could achieve as a result. 

Both have an important role. Vulnerability scanning provides broad, repeatable visibility of known weaknesses. Penetration testing combines tools with human expertise to examine attack paths, test exploitability and provide greater context around genuine business risk. 

Start by Understanding Your External Exposure 

Not every organisation knows whether it needs a full penetration test, which is why understanding your external exposure can be a valuable first step. 

Krome offers a free External Exposure Review, providing a high-level assessment of public-facing IP addresses and services as captured by commercial crawlers and spiders. 

It identifies what is easily visible to the outside world and whether that creates an obvious potential path into your network. 

This is not the same as external penetration testing. It doesn’t provide the same level of assurance as testing a full attack path. Instead, it provides an initial view of your external attack surface based on commonly used databases of internet-connected services, devices and applications. 

For organisations asking, “How do I know if my public IP addresses are vulnerable?” or “What can an attacker see?”, it provides a logical starting point before deciding if deeper testing is required. 

What Pen Test Should We Do?

How Krome’s Penetration Testing Works

How Often Should Penetration Testing Be Done? 

For many SMEs, annual penetration testing provides a useful baseline, but frequency should ultimately reflect risk and how quickly the environment changes. 

Additional testing should be considered following significant events such as: 

• Cloud migrations 
• New internet-facing applications 
• Application or API changes 
• Network redesigns 
• Changes to remote-access infrastructure 
• Acquisitions and integrations 
• Significant identity or access-control changes 

Clear Findings. Practical Next Steps. 

Finding vulnerabilities is only useful if you know what to do with them. Following a Krome penetration test, you receive a report explaining what was found, how weaknesses could be exploited, their potential business impact and the recommended next steps. 

Importantly, every finding is reviewed by a Krome Cyber Analyst and a senior member of our CISO team, helping ensure recommendations are practical, risk-focused and relevant to your environment. 

We deliberately filter out the noise. The objective isn’t to hand your technical team another enormous list of security issues. It’s to help them understand what matters, why it matters and where their time and resources will make the greatest difference.

See Your Organisation Through an Attacker’s Eyes 

As AI changes the speed and scale at which potential targets can be identified and assessed, relying on assumptions about security becomes increasingly difficult to justify. 

Effective penetration testing provides evidence. It shows what you expose, which weaknesses can actually be exploited, how an attacker could potentially move through your environment, and whether your defences are equipped to respond to both human-led intent and machine-led speed. 

Whether you need an external penetration test, network penetration testing, web application penetration testing, API penetration testing, Active Directory penetration testing, or simply want a clearer picture of your external attack surface, Krome can tailor the level of assurance to the risk. 

And if you’re unsure where to start, start with visibility. 

Krome’s free External Exposure Review provides an initial view of what your organisation exposes to the internet and whether deeper testing could be valuable. 

Talk to Krome about seeing your organisation through an attacker’s eyes