CREST announces first cohort of companies to achieve new AI-Enabled Penetration Testing accreditation

Posted by Rachel Simpson on 3 September 2026

10 companies have become the first to achieve the new industry first accreditation, which assesses responsible use of AI within penetration testing services.

LONDON, UK – 3rd September 2026 – CREST, the leading international non-profit representing the global cybersecurity industry, has accredited the first wave of cybersecurity service providers in AI-enabled Penetration Testing. The accreditation, which was launched in July 2026, assesses organisations against independent requirements for responsible, secure, and appropriate use of AI within penetration testing services. This builds upon the previously launched principles for the responsible use of AI, which over 100 organisations have now signed up to.

The first cohort marks a significant step in the development of independently assured AI-enabled cybersecurity services, providing an early benchmark for how AI can be incorporated into penetration testing while maintaining professional oversight and accountability.

The accredited providers are: 

Closed Door Security Ltd

ImmuniWeb

JUMPSEC Ltd

Packetlabs

Pentesys

REDSECLABS Private Limited

Risk Associates

SECNORA OÜ

Solusec Ltd

Thoropass Inc.

→ View these providers, and 500+ more, on CREST Marketplace

CREST’s global research highlights the pace of AI adoption within penetration testing. It found that over three-quarters (76%) of cybersecurity providers have increased their AI usage over the past year, and 69% are already integrating it into daily service delivery. Meanwhile, organisations are increasingly asking for greater transparency and evidence around how AI is being used within cybersecurity services.

Nick Benson, CEO of CREST, said: “As AI becomes increasingly ingrained in cybersecurity services, it’s crucial that the industry moves from discussion and principles towards independently assured, responsible adoption. It is clear that this is what clients are increasingly demanding of them. This latest accreditation provides a practical framework for doing exactly that, emphasising the combination of responsible practice with professional judgement, quality and human accountability.” 

The voluntary principles set out by CREST have an important role to play, but independent assurance provides an additional level of confidence. This standard, alongside the Security Testing of AI Accreditation released in August, represents the next step in independently verifiable assurance. 

William Wright, CEO of Closed Door Security, a UK and UAE-based CREST member, said: “AI offers significant support to penetration testing, helping security teams work more efficiently at scale, and identify vulnerabilities faster. However, it needs to be governed appropriately. Closed Door Security is proud to be part of the first CREST cohort to be accredited for AI-Enabled Penetration Testing, ensuring the technology is adopted safely to genuinely benefit and improve the security of organisations.”

Denis Kucinic, VP Operations at Packetlabs, a Canada-based CREST member, said:

“AI will be revolutionary for security providers like Packetlabs, but it’s vital that we assure customers, and the wider industry, that it’s being deployed and used responsibly. Accreditation providers like CREST help companies do exactly that. With independent and assessable standards, providers can back up voluntary promises with concrete assurance.”

Existing CREST Members and cybersecurity service providers can apply for this new accreditation, or download the CREST Accreditation Standards to learn more.

You may be interested in reading this...