Aikido Security is now CREST accredited

Aikido Security is now CREST accredited in the penetration testing discipline.
CREST is an international body accrediting cybersecurity service companies based on methodology, data protection, quality assurance, and personnel qualifications.
The firm's pentesting utilizes AI agents for continuous testing and validation of findings prior to reporting.
Some standards mandate that penetration tests be performed by a human tester.
Aikido offers both CREST-accredited, human-led penetration testing and autonomous AI pentests.
CREST accreditation applies specifically to the penetration testing discipline reviewed by the body.
Regulators, auditors, and procurement rules in banks, government bodies, and critical infrastructure often require proof of tester qualification.
The combination service allows for annual human engagement paired with continuous autonomous testing between audits.

The narrative successfully frames technological evolution—the integration of AI into security assurance—not as a risk to traditional validation, but as an augmentation that meets existing governance hurdles. The strongest interpretation is that the market demand from regulated entities is bifurcating: they require auditable proof of human oversight for certification checkpoints, while simultaneously benefiting from the scalability and continuous coverage afforded by autonomous systems between those mandated reviews. This creates an appealing composite offering where automation acts as perpetual 'maintenance' under the umbrella of periodic 'certification.'
The underlying assumption being tested here is whether regulators are ready to accept digital evidence generated autonomously when that system operates within a framework vetted by recognized human standards (CREST). The pattern observed is Authority Game, specifically leveraging the borrowed credibility of CREST accreditation. By aligning their AI capabilities with an already-vetted, human-centric standard, Aikido shifts the focus from "Is this AI safe?" to "Are we compliant with the human process?" This allows for a strategic soft transition toward autonomous validation by satisfying the highest current hurdles first.
The cost of this efficiency shift is subtle: it potentially commoditizes the 'proof' aspect of security—moving auditing away from verifying the *process* itself (which AI can mimic) toward trusting the credentials of the accrediting body and vendor who deploys that process. Who bears the true cost? The risk lies in regulatory inertia; if standards remain static, organizations may be structurally locked into paying for high-touch human reviews simply to validate software components that automated systems could monitor hourly.
If this model proves highly successful with risk-averse institutions, what pressure will it place on global certification bodies like CREST to define and certify AI autonomy itself, rather than just the processes surrounding it? How does a hybrid compliance model alter the ultimate accountability when an autonomous agent misses a zero-day vulnerability that a human would have found during a focused engagement? What unseen operational risks are introduced by allowing continuous, unsupervised automated systems access to core infrastructure?
Patterns detected: Authority Game