.jpg)
Cybersecurity industry body CREST has added additional standards to accredit AI penetration testing services.
Unveiled on July 28, the AI-Enabled Penetration Testing requirements are optional add-on requirements for cybersecurity service providers wishing to demonstrate responsible AI usage, both within their businesses and when delivering services.
This AI-Enabled Penetration Testing accreditation is a new optional module integrated into CREST’s existing Penetration Testing Accreditation Standard.
The new AI standards allow accredited providers who actively integrate AI into their daily operations to undergo independent assessment and formally demonstrate responsible, secure AI governance to clients and regulators.
“It won't affect standard memberships, but it gives providers using AI a way to verify their practices and earn an extra layer of trusted assurance,” a CREST spokesperson told Infosecurity.
Applications are now open for existing CREST members and cybersecurity service providers who wish to obtain additional recognition for the use of AI within their accredited penetration testing services.
CREST AI Penetration Testing Standards Follow Industry-Wide Adoption Surge
This new module launch follows the launch of CREST’s AI in Penetration Testing report, released in March.
The report found that over three-quarters (76%) of cybersecurity providers have increased their AI usage over the past year and that 69% are already integrating it into daily service delivery.
The report led CREST to publish a set of AI Principles in March and an AI Charter in June, which was publicly signed by over 100 cybersecurity organizations.
Like the AI principles and the charter, the AI additional standards have been developed by CREST’s AI Working Group, which will continue evolving them.
The optional AI-Enabled Penetration Testing requirements form part of the CREST Penetration Testing Accreditation Standard and provide independent assurance of responsible AI usage.
First Accreditations Coming Within a Month
Nick Benson, CEO of CREST, said these initiatives are designed to fix a gap that sees AI adoption outpacing governance.
“We recognize that buyers are increasingly demanding that AI-enabled services are independently assured. We believe these new additions to our standards will provide a practical, enforceable framework to regain the market’s trust.”
Speaking to Infosecurity, Benson also noted that, while no one has been accredited with the new AI-Enabled Penetration Testing module at the time of launch, the industry body expects the first accredited organization within the next month.
"We wanted to launch as soon as we could, if it took a few more months for some of our members to be accredited, it would not be as meaningful," he added.
“Unlike voluntary agreements, this formal accreditation integrates directly into CREST’s existing complaints and discipline processes. This allows CREST to take action and enforce compliance across the ecosystem.”
Chris Oakley, SVP of assurance services for the Americas at LRQA Cybersecurity, a US-based CREST member, said CREST’s new AI standards are based on the collective experience of cyber industry leaders and “provide a consistent answer to AI governance in cybersecurity.”
William Wright, CEO of Closed Door Security, a Dubai-based CREST member, noted that the new standard comes at a critical time as organizations are becoming increasingly dependent on AI.
“Advanced AI systems are steadily moving towards becoming critical infrastructure, and it is essential that organizations are confident in the security surrounding them. With them now being adopted to support security operations and to identify and remediate vulnerabilities, they require a framework approach for responsible usage that this new standard brings,” he explained.
.jpeg)
