SECNORA is one of the first 10 cybersecurity service providers to receive CREST AI-Enabled Penetration Testing accreditation, announced on 3 September 2026. CREST accredited providers across Europe, India and the US in this first wave, an early benchmark for incorporating AI into penetration testing while keeping professional oversight and accountability central. Built as an optional module on top of CREST’s existing Penetration Testing Accreditation Standard, the CREST AI-Enabled Penetration Testing Accreditation assesses how AI is used within the delivery of penetration testing, extending the accreditation it already holds to cover the responsible use of AI, wherever it plays a role in that delivery.
The Gap Between AI Adoption and AI Assurance
A CREST survey of 62 penetration testing providers across 19 countries found that AI is already becoming part of mainstream testing workflows. The survey found that 69% of providers are using AI in some part of their penetration testing activities, while 76% had increased their use over the previous year. Reconnaissance, analysis and report drafting were among the areas where AI was most commonly being applied.
The pace of adoption makes assurance increasingly important. AI can help testing teams work across larger environments and support different stages of an engagement, but the reliability of the final outcome still depends on how those capabilities are governed and reviewed. For buyers, that means looking beyond whether a provider uses AI and understanding how its use is controlled, where professional judgement comes in, and how confidence is maintained in the findings delivered. CREST AI-Enabled Penetration Testing accreditation provides an independent framework for assessing those practices.
What the CREST AI-Enabled Penetration Testing Accreditation Is
The CREST AI-Enabled Penetration Testing accreditation is the newest addition to CREST’s accreditation framework. Rather than simply confirming that a provider uses AI, it looks more closely at whether that use is governed responsibly and appropriately, covering the kind of everyday questions a client might otherwise just have to take on faith.
It builds on an idea CREST had already put forward through its AI Principles and Charter, that a voluntary commitment can only go so far without some way to check it against actual practice. SECNORA signed CREST’s AI Charter as one of its founding signatories, publicly committing to those principles early on. This accreditation feels like a natural next step from that commitment, giving it something more concrete than a public pledge: an external, independent assessment behind it.
SECNORA’s Commitment Under the CREST AI-Enabled Penetration Testing Accreditation
This accreditation covers both organisation-wide governance controls and requirements specific to the delivery of penetration testing itself, including:
- Approval and control: Material uses of AI must be approved and controlled at an organisational level.
- Human oversight: Appropriate human oversight must be retained over how AI is used.
- Data protection: Client and sensitive information must stay protected wherever AI is involved in the work.
- Legal and ethical compliance: AI use must hold up against relevant legal, contractual and ethical obligations, not just technical ones.
- Transparency: Clear visibility into how and where AI is incorporated into the delivery of testing.
- Scope and methodology: How AI is worked into testing methodology and whether it stays within an engagement’s agreed scope and rules.
Together, these requirements ensure that AI is used responsibly and consistently, while maintaining the quality, security and professional standards expected of penetration testing.
How This Fits SECNORA’s Existing AI Practice
Being part of the first cohort reflects that SECNORA’s approach to using AI within its penetration testing services has been assessed against CREST’s new standard. The accreditation provides external assurance around how AI is incorporated into the testing process, while keeping professional oversight and accountability central. For SECNORA, the approach is straightforward: AI can support security professionals across an engagement, but it does not replace the expertise and judgement required to interpret findings, understand their context and make informed security decisions.
- Validation: Wherever AI contributes a lead or finding, it goes through review by a tester rather than being reported without a human check.
- Context: Understanding what a finding means in a client’s specific environment stays a human judgement call, not an automated output.
- Ownership: If an AI-assisted conclusion turns out to be wrong, responsibility remains with the security professionals overseeing the engagement, not with the AI tool.
This ensures AI remains a supporting capability within SECNORA’s testing methodology, with accountability and judgement remaining firmly with its security professionals.
What This Accreditation Assures SECNORA’s Clients
Penetration testing findings feed directly into remediation priorities, risk registers, insurance renewals and, in regulated sectors, the compliance evidence submitted to auditors or regulators. When AI contributes to producing those findings, whatever governs that contribution eventually shows up in decisions made well outside the security team. That is why AI assurance is a procurement question, not just a technical one, and why the AI-Enabled Penetration Testing accreditation matters during due diligence. Independent accreditation turns a provider’s internal AI policy into something a buyer can actually reference during due diligence, rather than a claim taken on trust because it sounded credible in a sales conversation.
For organisations evaluating any provider that uses AI in testing, including SECNORA, it is worth asking:
- How is AI incorporated into the testing methodology and at what stage of the engagement does it sit?
- What level of human review applies to AI-assisted findings before they reach the client?
- What quality controls catch AI errors, false positives or unsupported conclusions?
- Who is accountable for a finding if it turns out to be wrong and how is that documented?
- Has the approach been independently assessed against a recognised standard or is it self-declared?
- Does client data stay inside the provider’s own controlled environment or does any of it pass through third-party AI tools?
Being able to answer these questions with clear, specific information, while also pointing to an external accreditation that supports those practices, gives organisations a more informed basis for evaluating a provider. It adds another layer of transparency to the procurement process and can help buyers better understand how AI is being incorporated into a security testing service.
What Changes, What Doesn’t
As AI becomes part of how penetration testing is delivered, the focus needs to extend beyond what AI can do to how it is governed within the testing process. For organisations, that means having greater visibility into how AI is used, where professional oversight applies, and how confidence in the resulting work is maintained. For SECNORA, the accreditation does not change our approach to professional judgement or the role experienced security professionals play in penetration testing. What it adds is independent assurance around how AI is incorporated into that process, with CREST assessing our approach against defined requirements for the responsible, secure and appropriate use of AI within penetration testing services.
The technology can continue to support different stages of an engagement but the governance surrounding its use now has independent validation against a recognised industry standard. For our clients, this provides an additional point of assurance they can consider during procurement and when evaluating how AI is incorporated into the penetration testing services they receive.
SECNORA helps organisations strengthen their security posture through CREST-accredited penetration testing and vulnerability assessments. Talk to our team.