AI penetration testing: evidence, tools and evaluation
Choosing an AI pentesting tool starts with the work you need it to do. Define the applications, accounts and environments in scope, then ask what evidence a finding includes and how a fix is verified. A demonstration or benchmark score answers only part of that question.
This reading path separates the basics, product behaviour and evaluation. Start with the guide if the terminology is new. Use the evidence and pricing articles when comparing proposals, and read the testing examples with their stated scope and limitations in mind. BreachLine builds Nebula, so our product articles describe our own system rather than an independent vendor ranking.
Understand what the tool actually does
Follow the testing workflow from a scoped task to an investigation. These articles explain Nebula and its browser capabilities so you can distinguish product behaviour from broad claims about AI.
Product
Meet Nebula: autonomous AI pentesting, explained
Meet Nebula, the AI security engineer inside BreachLine. Give it a task and follow autonomous security work in one software workspace.
Read the articleProduct
AI Browser Pentesting: HumanBrowser and Evidence
Evaluate AI browser pentesting with a practical workflow for authenticated sessions, cross-role checks, network evidence and reproducible findings.
Read the article
Evaluate evidence, claims and cost
Compare the proof behind a finding, the conditions behind a benchmark and the work included in a price. Ask for reproduction steps, coverage limits and retest terms before treating two offers as equivalent.
Industry Analysis
Working Exploit vs Scanner Finding for Questionnaires
Working exploit vs scanner finding: what enterprise security questionnaires actually accept, and how to turn coverage into adversarial proof.
Read the articleIndustry Analysis
AI Pentesting Tools: Compare XBOW and Alternatives
Compare AI pentesting tools and XBOW alternatives with a practical trial worksheet for scope, authenticated coverage, exploit evidence, retests and cost.
Read the articleIndustry Analysis
Claude Mythos and AI Pentesting: What the Evidence Shows
What Claude Mythos evaluations show about AI pentesting, how they differ from the earlier Opus experiment, and what buyers should verify on their systems.
Read the articleIndustry Analysis
What a Penetration Test Includes, and Why Prices Vary
What goes into a penetration test, why prices vary, and what to ask before you buy. Compare AI pentesting plans from £399 a month.
Read the article
Read an investigation and plan the next test
A patch, a code change or a new tool can change what needs testing. These examples focus on attack paths and verification. They are specific investigations, not evidence that every environment has the same weaknesses.
Offensive Research
Active Directory Takeover: Low-Priv to Domain Admin
How an AI security engineer chained DFSCoerce, NetNTLMv1, and DCSync to go from one low-privileged account to Domain Admin, live and fully anonymised.
Read the articleThreat Intelligence
Prompt Injection as RCE: Cursor, VS Code, and Antigravity
Three flaw clusters turned Cursor, VS Code, and Google Antigravity into a remote-code-execution surface in 2026. How each worked, and how to shut it down.
Read the articleThreat Intelligence
PHP2Shell: Patch PHP, Then Keep Testing
PHP2Shell is two critical PHP RCE flaws (CVE-2026-109618 and CVE-2026-109619). The versions that fix them, and why to keep testing after you patch.
Read the article
Tools and guides
Start with the AI penetration testing guide
How testing works, what it can miss, and how to choose and scope a tool.
Explore AI penetration testing with Nebula
Product scope, evidence, testing workflow and frequently asked questions.
Compare plans and credit allowances
Current platform prices, named seats, credit usage and retest terms.