FAQ
Quick answers to the questions people ask most about offensive security and AI-assisted testing.
Learning objectives
- Answer common questions about offensive security and how it differs from scanning
- Explain what makes testing legal and what human-in-the-loop AI means
- Point to the deeper Academy material for each topic
Short answers to the questions that come up most often, with pointers to the fuller Academy material. Use it as a fast orientation rather than a substitute for the deeper articles.
Offensive security
What is the difference between a vulnerability scan and a penetration test? A scan lists potential weaknesses automatically; a penetration test proves what is actually exploitable and how far it goes, with a human chaining issues into real impact.
What is "assumed breach"? It is testing from the premise that an attacker already has a foothold, and measuring what happens next, because eventually one will.
Is everything in here legal to do? Only against systems you are contracted and authorised to test, within agreed Rules of Engagement. The techniques are identical to an attacker's; the signed scope and duty of care are what make it a profession.
How do you decide a finding's severity? By risk (likelihood times impact in the client's context), calibrated with CVSS, not raw CVSS alone. See the severity and CVSS rubric.
AI-assisted testing
Does AI hack autonomously? In responsible practice, no. The strong model is human-in-the-loop: the AI enumerates, reasons and drafts at speed; a human approves every consequential action. Autonomy is broad for observing and analysing, and hard-stopped before acting dangerously.
What kinds of actions should need explicit approval? Credential-class actions (spraying, cracking, relay, roasting) and destructive web actions (state-changing requests, IDOR or injection writes). Each should be proposed and wait for an explicit go-ahead, with no carry-over.
Can AI invent findings in a report? It should not. A well-designed workflow drafts strictly from the engagement's real findings, evidence and commands, and a human reviews and signs. Overreliance on unverified model output is itself a listed risk in the OWASP LLM Top 10.
What are the risks of using LLMs and agents in testing? Prompt injection (especially indirect injection through content the model reads), excessive agency, unsafe tool use, and data leakage. The OWASP LLM Top 10 and Agentic Top 10 catalogue these; treat any LLM-backed tool as part of your own attack surface too.
Getting started
Where do I begin? Start with the Foundations material to build the concepts, then work through the attack-techniques track. This reference section (glossary, frameworks, tool index, severity rubric) is meant to stay open alongside the rest.
Do I need to memorise every tool and term? No. Understand the categories and the safety principles first; use the glossary and tool index as lookups. Recognition matters more than recall.
Related reading
- Glossary
- The tool index
- Frameworks and standards
Knowledge check
Answer without AI. This is your own recall. 70% to pass.
1.What is the key difference between a vulnerability scan and a penetration test?
2.What makes offensive-security techniques legal to perform?
3.What does human-in-the-loop AI testing mean?