Penetration Tests: Know Before You Buy
Source: YouTube · Black Hills Information Security · published Sep 11, 2026 · 1:08:48
This BHIS webcast is a buyer's guide to pentesting: AI is now a core expectation, but fully automated pentests with no human in the loop are a red flag 4:05.
Key Takeaways:
• AI flipped from a mark of "crap product" a year ago to a customer requirement; the offense/defense arms race makes it essential 3:51
• AI excels at repetitive grinding—API fuzzing, code/auth analysis, patch-diffing for PoCs—adding depth within time budgets 6:07
• AI struggles with context, prioritization, novel vulns, false positives, scope, and chaining—seasoned testers are critical 12:49
• Cost savings depend on test type: simple externals yes; web apps and legacy internals often add manual validation work 20:03
• Use the "pyramid of pain" continuum and ask vendors how AI is used, where models run, data governance, logging, and human validation 34:55
• Red flags: no sample report, no scoping call, scans sold as pentests, no retest terms, inability to name competitors 55:20
• Differentiators: direct tester access, detailed self-verify methodology in reports, continuous pentesting relationships 39:12
Beware cheap fully automated AI "puppy mills" pushing unvalidated criticals—ask hard questions and prioritize humans in the loop.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. Welcome to today's BHS Black Hills webcast. Today we have Tom, John, and Logan on and they're going to talk about what you need to know before you buy a pentest. Now, I know we're a pentesting company, but I never been pitched why I should buy a pinest. So, I'm very curious to learn what would I need when I have a pentest. And do you think this website is going to help people like me, whether they work in infoscept or maybe they don't work in their field, in a different uh industry, but they want to know how do I know I need to buy buy a pentest? Yeah. And uh and like I'm going to start it out and I'm going to talk specifically about the AI aspects and how penetration testing has changed. And then we're going to get into the types of penetration test and then Tom and Logan …