Artificial intelligence is rapidly changing how organisations develop software, manage infrastructure and respond to cyber threats.

But as businesses accelerate their adoption of AI, another question is becoming increasingly important: Can traditional Vulnerability Assessment and Penetration Testing (VAPT) keep pace with an AI-driven threat landscape?

VAPT has long been a fundamental component of cybersecurity programmes.

Vulnerability assessment helps organisations identify weaknesses across applications, networks and systems, while penetration testing attempts to validate whether those weaknesses can actually be exploited.

For years, the methodology has remained relatively familiar. Security professionals scan systems, analyse vulnerabilities, conduct controlled exploitation and produce reports recommending remediation.

The arrival of generative AI and increasingly autonomous systems is changing that environment.

AI is changing both sides of the security equation

AI can help defenders analyse enormous volumes of security data, identify patterns and prioritise vulnerabilities. Security teams can use AI-assisted tools to accelerate reconnaissance, analyse code and improve vulnerability triage.

At the same time, attackers can also use AI to increase the speed and scale of reconnaissance, social engineering, malicious code development and vulnerability research.

This creates a cybersecurity environment in which organisations may no longer be dealing simply with conventional applications and networks. They may also be protecting AI models, APIs, data pipelines, agentic systems, plugins, cloud infrastructure and the permissions granted to autonomous applications.

That raises a significant issue for VAPT.

Testing only the traditional technology stack may no longer provide a complete picture of an organisation’s attack surface.

The AI attack surface

AI systems introduce new areas that security teams need to consider.
These can include model and API security, authentication and authorisation, sensitive data exposure, insecure integrations, prompt injection, excessive permissions and weaknesses in the infrastructure supporting AI workloads.

For organisations deploying AI agents, the question becomes even more complicated.

An AI agent may be capable of accessing databases, sending messages, calling APIs or interacting with enterprise applications. A vulnerability in the agent itself is therefore only part of the security equation.

The security assessment also needs to examine what the AI system is allowed to do when something goes wrong.

This shifts the conversation from simply asking, “Is the system vulnerable?” to also asking, “What can an attacker make the system do?”

VAPT needs to become more continuous

The traditional annual or periodic penetration test still has value. However, organisations operating rapidly changing cloud and AI environments may need a more continuous approach to security validation.

New software releases, APIs, models, integrations and configurations can change an attack surface considerably between two testing cycles.

AI-assisted security testing could help organisations analyse these changes more quickly. But automation should not be confused with complete security assurance.

Human expertise remains important because vulnerabilities often involve business logic, architecture, access privileges and organisational processes that automated tools may not fully understand.

The role of the cybersecurity professional

The rise of AI does not necessarily make penetration testers less relevant. Instead, it could change the skills expected from them.

The modern security tester increasingly needs to understand cloud environments, APIs, application security, identity management, data protection and AI architectures alongside conventional penetration-testing techniques.

The ability to interpret findings and understand their business impact may become just as important as discovering vulnerabilities.

From vulnerability reports to resilience

Perhaps the biggest change should be in how organisations view VAPT.
A penetration-testing report should not simply become another document stored in a compliance folder.

The real objective is to understand where an organisation can be attacked, how an attack could progress, what information or systems could be affected, and whether existing controls would detect and contain the activity.

In the age of AI, that means testing not only individual applications but also the relationships between humans, applications, models, data and automated systems.

AI is changing the cybersecurity battlefield, but the fundamental principle remains unchanged: organisations cannot protect what they do not understand.

VAPT therefore still has an important role. The challenge is ensuring that VAPT itself evolves quickly enough to test the technologies, architectures and attack scenarios that define the AI era.

The future of VAPT may not be about replacing human testers with AI. It may be about combining human security expertise with AI-assisted testing to create faster, broader and more intelligent security validation.

This commentary shared by Ramani Parkunan who manages Hipz Media. Anyone wants to know more about VAPT services email him at hipzmedia@gmail.com