Parabellum CREST AI-Enabled Penetration Testing Accreditation

AI in penetration testing: why we had ours independently assessed

Parabellum is now CREST accredited for AI-Enabled Penetration Testing – one of only three providers in Asia-Pacific, and 13 worldwide.
‍

AI is already part of how most penetration testers work. What clients rarely get is a clear answer to how it's used: which tools, what happens to their data, and who checks the output before it lands in a report.
‍

We think clients deserve that answer, and they deserve it to come from someone other than us. So we put our use of AI in front of CREST for independent assessment. As of this month, Parabellum is accredited for AI-Enabled Penetration Testing. We're one of two providers in Australia, three in Asia-Pacific and 13 worldwide to hold it since CREST introduced the standard in July 2026.

What the accreditation actually covers

CREST is the international not-for-profit body that accredits security testing providers. In July 2026 it added an optional AI-Enabled Penetration Testing module to its Penetration Testing Accreditation Standard, alongside a new Responsible AI Use domain in its general company requirements.

It assesses how a provider uses AI in its own work. In short, CREST looks at three things:

• Governance - which AI tools are used, who approves them, and how their use is controlled and recorded.
• Data protection - how client data is handled when AI is involved, and where it goes.
• Human oversight - that a qualified tester directs the work and validates every AI-assisted finding before it reaches a client.

It isn't an endorsement of any product or tool (including our offensive AI tool - Otis™) but rather an assessment of how a company works. It also sits inside CREST's complaints and discipline processes, so it carries real accountability, unlike a voluntary pledge.

Why it matters if you buy penetration testing

CREST's own research found that 69% of penetration testing providers already use AI, and 76% increased their use over the past year. AI adoption in our industry is moving faster than the governance around it.
‍

That creates a real risk for buyers. A penetration test gives a provider deep access to your systems, and the results describe exactly where you're weakest. If that information is fed into an AI tool with no clear controls, you may not know where it ends up.

There's a quality risk too. AI can produce confident findings that are wrong, or miss what an experienced tester would catch. A report is only as trustworthy as the person who checked it.

That's why 85% of providers surveyed by CREST expect clients to ask for more transparency about AI. An independent accreditation gives you a way to check, rather than taking a provider's word for it.

How we use AI

Attackers are already using AI to move faster and find more. To test your defences realistically, we use it too. But we use it the way we approach everything at Parabellum: as stewards of what our clients trust us with.

• Our testers lead. AI helps our offensive security specialists cover more ground, faster. It never decides what's in scope, and it never replaces their judgement.
• Every finding is validated by a person. Nothing AI-assisted reaches a report until one of our testers has confirmed it.
• Client data stays under control. We only use approved AI tools under contracts that prohibit retaining your data or using it to train models.
• We're open about it. If you want to know how AI will be used in your engagement, ask us. We'll tell you.

Five questions to ask any provider about AI

Whoever you work with, these questions will tell you a lot:

1. Do you use AI in testing, and for which parts of the work?
2. Which AI tools or services will see our data, and where are they hosted?
3. Do those services retain our data, or use it to train models? What does the contract say?
4. Who checks AI-assisted findings before they reach our report?
5. Has your use of AI been independently assessed?

A good provider will answer all five without hesitation.

What this means for you

This accreditation builds on our existing CREST Penetration Testing accreditation, our ISO 27001 certification and our commitment to the CREST AI Charter. For our clients, from SMEs to critical infrastructure and government, it means faster, broader testing, with independent assurance that quality, judgement and data protection come first.
‍

Thank you to our team for the work behind it, and to CREST for setting a clear standard for responsible AI in our industry.
‍

Want to know how AI would be used in your next engagement? Get in touch, we're happy to walk you through it.
‍

Sources: CREST AI in Penetration Testing research (March 2026) and CREST Penetration Testing Accreditation Standard, Annex B. Accreditation is active as at October 2026.

‍