AI
Evolution of Offensive Security and the Automation Imperative
Offensive security started as scattered knowledge shared in obscure corners of the internet. Compliance requirements and rising attack rates pulled individual practitioners into a service industry. Bug bounty programs followed, giving companies continuous access to researchers who could hammer applications over time.
The attack surface kept growing. Asset inventory remains a persistent failure point: companies don’t know what they’ve exposed, can’t classify what holds PII versus PCI data, and struggle to maintain a single source of truth across cloud and on-premises infrastructure. Companies that keep build, defend, and attack capacity in balance get breached less. The ones that build faster than they can test are the ones waiting for a question of when.
AI-Driven Threat Intelligence Pipelines
The team built their threat intel pipeline in n8n. A time trigger fires the flow, RSS nodes pull security news, JavaScript code nodes filter yesterday’s items, and an LLM node prioritizes what remains. Output converts from Markdown to HTML and ships via SMTP. They walked through the n8n threat intel news aggregation flow (05:02) live. The flow proved useful enough that they turned it into a newsletter.
The same pattern reaches inward. Jira planning docs, merge requests, and code repository activity pipe into the same automation layer, turning internal company context into a prioritized feed of what to test next.
Continuous Automated Reconnaissance
You can’t protect what you don’t know you have. The Shodan-based IP range reconnaissance workflow (10:30) runs weekly, queries the Shodan API for the company’s known IP ranges, routes results through an AI analyst node, and pushes a complete analysis to a notification channel. The certificate transparency domain discovery on autopilot (11:35) cross-checks every newly issued TLS certificate against the known domain list, runs DNS and HTTP probing on each match, flags anomalies and IOCs, and updates the monitored list automatically.
“we can have basically domain discovery on autopilot.” — Carmen Ruset
Put both on a recurrent schedule and asset discovery never waits on a human to remember to look.
Automated Threat Modeling as a Continuous Feedback Loop
Threat modeling is typically a one-time exercise, done at project kickoff and forgotten. Ruset’s approach runs it as a continuous loop. An n8n workflow pulls from Jira tickets, internal documentation, ServiceNow incidents, and code repository activity, then feeds that context into an AI orchestration layer to generate an updated threat model on demand. As microservices spin up and disappear in minutes, a static threat model is already outdated.
“the time to exploit has become minus one day days. And that means attackers are already exploiting before we even got to develop the patches for the vulnerabilities.” — Carmen Ruset
The feedback loop closes when assessment results feed back into the model. That is why, as Ruset put it:
“pentesting is no longer just a skill but an orchestration of tools and automation.” — Carmen Ruset
Agentic Testing and AI-Assisted Reporting
The n8n execute-command block gives an LLM direct shell access: run WPScan or Nuclei against a target, feed the raw output back, and get interpretation plus proposed remediation in one pass. The n8n agentic WPScan and Nuclei testing flow (20:28) shows the full loop. Reporting gets the same treatment. Plunderdoc had no MCP server, so Covrig vibe-coded one with Gemini CLI. The Vibe-coded Plunderdoc MCP server for automated reporting (30:34) reads tool logs from the project directory and pushes structured findings straight into Plunderdoc. A human still reviews; writing is no longer the bottleneck.
Future of Offensive Security: Signal-Driven Continuous Testing
Pentesting will shift from scheduled snapshots to signal-triggered tests. As companies generate more internal signals — code merges, Jira changes, new deployments — those signals fire the relevant playbook. Repeatable, modular offensive flows run when the signal says something changed, not on an arbitrary quarterly calendar. AI handles recon, payload generation, and reporting; humans decide which test cases require manual judgment.
“the takeaway is that we are not being replaced but we are being enhanced with all of these technologies” — Andrei Cristea
Q&A
How would you technically combat the inconsistencies that result from interacting with an LLM, especially when you embed them in big flows, because of course you need reliability and accuracy? Double-checking outputs against a company-trained model, then cross-referencing generated threats against actual code in Sourcegraph to confirm each threat is valid at the code level. ▶ 39:56
Doesn’t this automation create a problem with creating new agents, new hires, new people, because we all learned by taking actions and making pentests and writing reports? Won’t this automation lower the quality of the new stuff? The speaker gave a partial answer about maintaining control over the tool’s decision-making but acknowledged they didn’t fully hear the question and deferred further discussion to after the session. ▶ 41:45
How does the tool get the severity and the CVSS score of the vulnerability? And do you get false positives, and if so what’s the percentage? CVSS accuracy depends on how much application context is fed to the model, false positive percentages are unknown because the reporting automation is still in personal testing and not officially deployed. ▶ 43:20
How heavily will you rely on MITRE-related matrices — ATT&CK, Atlas — when you use threat modeling to plan your offensive security activities? The LLM is instructed to map generated threats to MITRE and other standards based on scope (application vs. infrastructure type), followed by manual validation of whether each mapping is correct. ▶ 50:38
Notable Quotes
pentesting is no longer just a skill but an orchestration of tools and automation. Carmen Ruset · ▶ 18:13
the time to exploit has become minus one day days. And that means attackers are already exploiting before we even got to develop the patches for the vulnerabilities. Carmen Ruset · ▶ 16:57
we can have basically domain discovery on autopilot. Carmen Ruset · ▶ 13:20
the takeaway is that we are not being replaced but we are being enhanced with all of these technologies Andrei Cristea · ▶ 38:10
I would never as a pentest start training such a model because if I were to do that I would change my job. Andrei Cristea · ▶ 48:38
Key Takeaways
- Deploy n8n or equivalent no-code pipelines to turn raw security news into prioritized, actionable intelligence automatically.
- Run continuous Shodan and certificate transparency monitoring so asset discovery never depends on a human remembering to look.
- Automate report drafting with LLM agents so pentesters spend time validating impact, not copy-pasting vulnerability descriptions.
About the Speakers
Andrei Cristea
Andrei Cristea is a passionate and results-oriented Offensive Cybersecurity Specialist with 10 years of experience on the consultant and client side. Specializes in leading teams and delivering proactive cybersecurity services, including penetration testing, purple team, and red team engagements. Adept at identifying sophisticated cyber threats and committed to building strong client relationships to illuminate attack surfaces, recommend actionable remediation, and measurably improve their cybersecurity posture.
Carmen Ruset
Carmen is an energetic and passionate Offensive Cybersecurity Specialist with 7 years of hands-on experience in consulting and offensive security. She has led and coordinated a wide range of security assessments - from penetration testing to purple team exercises, helping organizations uncover complex threats. A strong advocate for embedding threat modeling into security assessments, she emphasizes proactive strategies to illuminate attack surfaces and harden systems against potential adversaries. She is equally dedicated to building automation that boosts security efficiency and empowers security teams to maximize their impact.
Constantin-Danut Covrig
Passionate about automation and process simplification, continually seeks innovative ways to improve efficiency and accuracy in security practices. Currently focused on advancing penetration testing services and maximizing the impact in building and maintaining secure organizations.