Posted by Catherine Jones on 19 October 2026
How Packetlabs made AI-enabled penetration testing easier to trust
Client contracts were increasingly restricting AI use. Packetlabs used CREST’s AI-enabled penetration testing accreditation to strengthen and evidence its controls, giving clients greater confidence in how it uses AI.
About Packetlabs: Packetlabs is an offensive cybersecurity company specialising in penetration testing services, with testers in Canada, the US and Australia. The company has been a CREST member for four years and in operation since 2011. Chief Executive Officer Richard Rogerson sits on the CREST North America Council and leads its Canadian working group.
A cautious approach to AI
Prior to seeking CREST accreditation for its AI-enablement, the Packetlabs team was already exploring how AI could help its testers work faster and investigate more of a client’s environment during each engagement. They saw particular value in speeding up intelligence gathering, pretexting and the validation of specific vulnerabilities, freeing testers to investigate areas they might not otherwise reach. But their approach was cautious. Testers remained responsible for the work and AI remained a tool, never a substitute for their expertise.
As Richard explains:
“We live in a business that is sceptical of everything. When you look at the exposure of AI and you look at AI being used inappropriately, we were always very cautious and our buyers are the same. So we wanted to make sure that when we did implement AI, we did it responsibly.”
Why Packetlabs needed independent assurance
The immediate pressure came through client contracts. Richard has the final approval on every master services agreement and statement of work, and he’d seen restrictions on AI spread from large enterprises into the mid-market and smaller businesses. Some clients had banned it outright. Others wanted approval rights and proof their data would stay protected.
Packetlabs needed a position it could explain and defend. It had begun examining other frameworks, including ISO 42001, when CREST introduced its accreditation for AI-enabled penetration testing. Because the requirements dealt directly with AI in a penetration testing service, they provided a practical route through questions Packetlabs was already trying to answer.
“We felt that it added that level of transparency. So clients knew exactly what they were getting into, where we were using it, where we were not using it, and the guardrails we’d put in place to make sure that it’s safe for use in their environment.”
Working through CREST’s requirements
CREST’s standards gave Packetlabs clear requirements and showed the team where its existing approach could be strengthened. They took the standard apart bullet by bullet and mapped every requirement to evidence. Leadership, operations, research and development, and technology staff worked through the company’s policies, systems, client approvals and legal agreements. Richard estimates the work took just over two weeks and led to revisions across 12 organisational artefacts.
“We went through point by point and made sure that we had evidence for everything that was required. We didn’t want to go through the process and say, ‘Of course we do this,’ but not have anything to back it up.”
Packetlabs incorporated AI controls into every stage of an engagement. Master services agreements and statements of work now record whether a client authorises AI use. The decision feeds into the rules of engagement, so each tester knows what the client has approved. Testers sign the acceptable use policy and remain accountable for anything they put into the company’s self-hosted AI environment. They cannot use consumer-grade tools for client work.
“We make our testers accountable for what they’re using AI for. It’s not the AI tool that’s accountable. The tester is the one who’s responsible for what we’re using the AI for.”
Packetlabs also amended its data classification standard. Restricted client data never enters an AI tool. Staff may use confidential data only in tightly defined cases, with the required approval. The process strengthened controls Packetlabs already had rather than forcing it to build a separate system around AI.
CREST assigned Packetlabs an accreditor who pressure-tested the evidence and questioned any wording or decision that was unclear. The team refined their documents until they captured the intent of each control. Richard describes the accreditation process as collaborative and says the preparation meant there were no last-minute changes or surprises.
“What clients expect is to make sure that if we’re adopting a standard, it actually means something. It’s not just a check mark or a check box on your website. This is something we believe in.”
Successful accreditation has transformed client conversations around AI. Packetlabs can now share its policy, point to independent assurance and show exactly how it will protect client data. Clients who approve AI-assisted testing can benefit from faster validation and greater depth. Those who remain uncomfortable can opt out, and that choice follows the engagement through to the tester doing the work.
Clients now ask specific questions about the use of AI on engagements, instead of imposing blanket restrictions. The accreditation has also given sales, marketing and delivery teams more confidence when they explain the service.
“It’s alleviated 90% of the questions about how it’s being used because it’s already documented. It’s already a standard that we follow.”
Looking ahead to the future
Packetlabs plans to track the proportion of clients that allow AI-assisted testing and whether that figure rises over time. Richard expects AI to support more frequent and eventually continuous testing, while qualified people continue to direct the work and judge the results.
His advice to other providers is to use CREST’s AI-enabled penetration testing accreditation to answer clients’ questions before they ask them. For Packetlabs, it’s made AI part of the sales and delivery conversation while giving each client control over whether and how it’s used.
Read more about Packetlabs’ journey to AI accreditation on their own blog.
Evidence your responsible use of AI
If your company uses AI within penetration testing, our AI-enabled Penetration Testing accreditation provides independent assurance of your controls, so you can reassure clients their data is protected and that AI is used safely within their environments.
You may be interested in reading this...
