How AI changes the junior pentester role

A finding arrives for review. It reads well, the structure is clear and the language sounds confident. When you ask the junior tester to explain it, they cannot account for every claim. AI assistance can make that gap harder to spot if the review stops at the finished paragraph.

Consider a hypothetical exercise involving a file download function. The tester has shown that one account can retrieve a document belonging to another user. An AI-assisted draft describes unrestricted access to all customer documents. The evidence supports the observed download; the wider claim still needs a basis.

Working through that difference together lets the junior correct the finding and gives the supervisor a clearer view of what they understand.

Have the tester write from the evidence first

Start with the tester’s notes and captured requests. Ask them to write the finding without an AI-generated draft. They should identify the account used and the document returned, then explain how the result crossed the expected access boundary.

The first draft can be rough. Its value is in showing how the tester got from the request to the conclusion. If they cannot explain why the document should have been inaccessible, that is the point to pause and check the intended permissions.

Keep this version. It gives the supervisor a record of what the tester understood before receiving suggestions, and it gives the junior something to compare with the revised finding.

Writing every future finding this way may be unnecessary once the tester can demonstrate the skill. For an unfamiliar weakness or a new joiner, however, the initial draft is useful evidence of understanding.

Review the suggested changes together

Use an approved tool in line with the team’s rules for handling client information. Those rules should establish which material can be supplied to the tool. The training exercise can use synthetic material where necessary.

Ask the tool to review the draft’s clarity. The tester should then check each substantive change against their notes. A clearer sentence is useful only if it still describes the result accurately.

In the document example, an assertion about all customer documents should prompt a review of the evidence. The tester may have a sound reason to infer wider exposure. If so, the finding needs to explain that reason and distinguish it from the download actually performed. Otherwise, remove the broader claim.

Remediation needs the same attention. A suggestion to block the observed request pattern may leave the underlying authorisation failure unresolved. The tester needs to describe the access check the application requires and retain legitimate downloads.

A brief note of the changes accepted and claims rejected is enough to make the review useful later. It shows how the tester weighed the suggestions, including where they chose to leave their own wording in place.

Make the review a conversation about the work

Ask the junior to explain the result using the evidence, without reading the finding aloud. Follow up on any point where the explanation differs from the report.

A supervisor can use a short set of checks:

• Identify the starting account and its intended permissions.
• Trace the request to the document returned.
• Explain which claims describe observations and which rely on inference.
• Describe how a retest would establish that unauthorised access has been prevented.

Those questions turn the review into a conversation about what the tester knows. AC/DC provides a wider QA standard for checking whether the finished work is ready for the client.

If the junior cannot explain part of the finding, return to the test or use a supervised lab exercise. A reviewer should correct unsupported report content before release, while also addressing the knowledge gap that allowed it through.

Keep room for investigation

AI can help organise unfamiliar material or suggest an avenue to investigate. Juniors still need opportunities to work through results that do not match their expectations. Otherwise, a supervisor has little evidence of how they handle uncertainty.

For a training task, ask the tester to propose their next test before showing them generated suggestions. Discuss the objective of that test and what its possible results would establish. Let them revise the approach when there is a better reason to do so.

CREST’s principles for AI-enabled activities call for competent oversight, reviewable outputs and activity within agreed controls and client scope. For this exercise, that means a named reviewer who can challenge the generated text and take responsibility for approving the work. The exercise is my practical way of developing that skill.

Count the review effort as well

It is easy to notice the faster first draft. Include the time spent checking suggestions when deciding whether the tool helped the engagement overall. If reviewers keep correcting the same invented claim, the tool or the way it is being used needs attention.

Keep examples of work the junior can now explain independently. As that evidence develops, adjust the supervision to match. Before allowing more independent use, establish that the tester can recognise an unsupported claim and knows when to ask for help.