Cybersecurity industry body CREST has granted 10 companies with its newly established accreditation that recognizes responsible use of AI within penetration testing services.
This AI-Enabled Penetration Testing accreditation is a new optional module integrated in July 2026 into CREST’s existing Penetration Testing Accreditation Standard.
The first cohort of accredited providers include firms spanning Europe, India and the US:
- Closed Door Security Ltd
- ImmuniWeb
- JUMPSEC Ltd
- Packetlabs
- Pentesys
- REDSECLABS Private Ltd
- Risk Associates
- SECNORA OÜ
- Solusec Ltd
- Thoropass Inc.
The new AI standards allow accredited providers who actively integrate AI into their daily operations to undergo independent assessment and formally demonstrate responsible, secure AI governance to clients and regulators.
The new module will not affect standard memberships, but it gives providers using AI a way to verify their practices and earn an extra layer of trusted assurance.
AI in Penetration Testing: Industry Adoption and Responsible Integration
William Wright, CEO of Closed Door Security, a UK and UAE-based CREST member, emphasized the impact of AI on pentesting, which he said is “helping security teams work more efficiently at scale, and identify vulnerabilities faster.”
“However, it needs to be governed appropriately. Closed Door Security is proud to be part of the first CREST cohort to be accredited for AI-Enabled Penetration Testing, ensuring the technology is adopted safely to genuinely benefit and improve the security of organizations,” he added.
Denis Kucinic, VP Operations at Packetlabs, a Canada-based CREST member, agreed: “AI will be revolutionary for security providers like Packetlabs, but it's vital that we assure customers, and the wider industry, that it's being deployed and used responsibly. Accreditation providers like CREST help companies do exactly that. With independent and assessable standards, providers can back up voluntary promises with concrete assurance.”
Nick Benson, CEO of CREST, said the AI additions to the accreditation help the cybersecurity industry “move from discussion and principles around AI towards independently assured, responsible adoption.”
CREST’s AI Principles and Charter Promote Responsible Adoption
The launch of the AI-Enabled Penetration Testing accreditation module followed the launch of CREST’s AI in Penetration Testing report, released in March 2026.
The report found that over three-quarters (76%) of cybersecurity providers have increased their AI usage over the past year and that 69% are already integrating it into daily service delivery.
The report led CREST to publish a set of AI Principles in March and an AI Charter in June, which was publicly signed by over 100 cybersecurity organizations.
Image credits: CREST / Matt Fowler KC / Shutterstock.com