AI-assisted pentest at assistsec at our company

After seven years as a CISO in the Belgian fintech industry and working with multiple penetration testing providers, I thought I knew what to expect from a penetration test. My recent experience with AssistSec proved otherwise. Over the years, I've seen different approaches, methodologies, reporting standards, and levels of technical expertise.

You also become somewhat critical of the results. After all, when you've worked with several penetration testing companies, you start recognizing patterns in how assessments are conducted and what typically ends up in the final report.

Recently, we decided to try something different. We engaged AssistSec for an AI-assisted penetration test. Honestly, I wasn't expecting to be this impressed.

The results genuinely surprised me

I want to be careful here. I'm not saying that every previous penetration test we conducted was bad, nor am I suggesting that traditional penetration testing is no longer valuable.

However, the number and quality of findings delivered by AssistSec genuinely caught me off guard.

They identified vulnerabilities and security issues that had not been uncovered during previous assessments conducted by other penetration testing providers.

For someone who has been involved in security assessments for years, that's quite something. Especially the pricing perspective too.

What impressed me wasn't simply the quantity of findings. It was the quality of the technical work, the depth of the assessment, and the way the results were presented. It was explained in a way that was understood by everyone, even the non-technical executives.

This is ultimately what I expect from a penetration test.. not just another report confirming what we already know, but an assessment that challenges our assumptions and helps us discover things we haven't seen before.

One of the interesting aspects of AssistSec is its AI-assisted approach to penetration testing.

There is a lot of discussion in the cybersecurity industry about artificial intelligence, particularly around how AI can transform vulnerability discovery, security testing, and offensive security operations.

However, there is a significant difference between simply putting an AI tool in front of an application and building a professional penetration testing service around AI-assisted capabilities.

What stood out to me was the combination of technology, technical expertise, and professionalism.

The AssistSec team was extremely professional throughout the engagement. Communication was clear, the process was structured, and the overall experience was excellent.

Another aspect worth highlighting is their platform: ARGUS.

Anyone who has managed multiple penetration testing engagements knows that reporting and tracking findings can become a challenge.

Traditional penetration testing reports often end up as PDFs, spreadsheets, or findings scattered across different tools.

Continuous penetration testing. Moving beyond annual assessments

Following our initial experience, we also decided to engage AssistSec for continuous penetration testing on a monthly basis.

And this is something I would encourage other organizations to seriously consider. The traditional approach to penetration testing often involves scheduling an assessment once or twice a year, receiving a report, remediating the findings, and waiting until the next assessment.

But the problem is that we are constantly growing, we have a whole dev team that is building stuff 24/7. Applications change. New features are deployed. Dependencies evolve. Infrastructure gets updated. And ofcourse… new vulnerabilities emerge. Give that assistsec discovered ALOT of findings during the pentest we gave it a go….

Our monthly engagement with assistsec gives us an additional layer of security assurance and helps us move away from treating penetration testing as a once-a-year compliance exercise.

Did you guys ever done a pentest at assistsec? i'd like to read about it in the comments.. LMK! what do you guys think about this new pentest company.