The non-profit representing the cybersecurity sector, CREST, has accredited a first ten cybersecurity service providers in AI-enabled Penetration Testing. The accreditation, as launched in July 2026, assesses organisations against independent requirements for responsible, secure, and appropriate use of AI within penetration testing services. This builds upon the previously launched principles for the responsible use of AI, which over 100 organisations have now signed up to.
According to CREST, this provides an early benchmark for how AI can be incorporated into penetration testing while maintaining oversight and accountability. The accredited providers are:
- Closed Door Security Ltd
- ImmuniWeb
- JUMPSEC Ltd
- Packetlabs
- Pentesys
- REDSECLABS Private Limited
- Risk Associates
- SECNORA Oร
- Solusec Ltd
- Thoropass Inc.
CRESTโs global research highlights the pace of AI adoption within penetration testing. It found that over three-quarters (76pc) of cybersecurity providers have increased their AI usage over the past year, and 69 per cent are already integrating it into daily service delivery. Meanwhile, businesses are increasingly asking for greater transparency and evidence around how AI is being used within cybersecurity services.
Nick Benson, CEO of CREST, said: โAs AI becomes increasingly ingrained in cybersecurity services, itโs crucial that the industry moves from discussion and principles towards independently assured, responsible adoption. It is clear that this is what clients are increasingly demanding of them. This latest accreditation provides a practical framework for doing exactly that, emphasising the combination of responsible practice with professional judgement, quality and human accountability.โ
The voluntary principles set out by CREST have a role to play, but independent assurance provides further confidence. This standard, alongside the Security Testing of AI Accreditation released in August, represents the next step in independently verifiable assurance, CREST suggests.
William Wright, CEO of Closed Door Security, a UK and UAE-based CREST member, said: โAI offers significant support to penetration testing, helping security teams work more efficiently at scale, and identify vulnerabilities faster. However, it needs to be governed appropriately. Closed Door Security is proud to be part of the first CREST cohort to be accredited for AI-Enabled Penetration Testing, ensuring the technology is adopted safely to genuinely benefit and improve the security of organisations.โ
And Denis Kucinic, VP Operations at Packetlabs, a Canada-based CREST member, said: โAI will be revolutionary for security providers like Packetlabs, but it’s vital that we assure customers, and the wider industry, that it’s being deployed and used responsibly. Accreditation providers like CREST help companies do exactly that. With independent and assessable standards, providers can back up voluntary promises with concrete assurance.โ
More details
CREST members and cybersecurity service providers can apply for this new accreditation, or download the CREST Accreditation Standards to learn more.
