Loading story…
CREST has introduced a new optional AI-Enabled Penetration Testing accreditation module as an add-on to its existing penetration testing standard, giving cybersecurity service providers a way to independently demonstrate responsible and secure AI governance in both internal operations and client-facing testing engagements. The body said the move responds to rapid AI adoption across the sector and growing customer demand for independently assured AI-enabled services, and it expects the first organization to achieve the accreditation shortly after launch.
The accreditation follows CREST’s broader push to formalize AI safeguards for cyber services through its AI Principles and an AI Charter backed by more than 70 firms at launch and later cited alongside support from over 100 organizations. The charter sets nine principles spanning governance, transparency, auditability, human oversight, data sovereignty, secure development, supply-chain assurance, and resilience, while requiring firms to disclose AI use to clients, maintain reviewable records, and protect client data, prompts, outputs, and AI-generated assets. CREST said the framework is intended to move the industry from voluntary commitments toward independently assessable standards for AI-enabled security services.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On July 28, CREST introduced optional AI-Enabled Penetration Testing requirements as an add-on to its existing Penetration Testing Accreditation Standard. The module allows cybersecurity service providers to undergo independent assessment of responsible and secure AI governance in internal operations and client-facing pentesting services.
On July 9, CREST launched its AI Charter for responsible AI use in cybersecurity services. The charter debuted with 73 founding signatories and set out nine principles covering governance, transparency, auditability, human oversight, data handling, secure development, supply-chain assurance, and resilience.
CREST published its AI Principles for AI-enabled cybersecurity activities. Later reporting says these nine principles were initially revealed in March and informed subsequent CREST AI governance initiatives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourcecrest-approved.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HackerOne announced a **Good Faith AI Research Safe Harbor** framework intended to give AI security and safety researchers clearer authorization and legal protections when testing AI systems in good faith. The initiative is positioned as an industry standard to reduce legal ambiguity that can deter responsible AI testing, and it builds on prior efforts such as the U.S. Department of Justice’s 2022 policy shift on “good faith” security research under the **Computer Fraud and Abuse Act (CFAA)** and HackerOne’s earlier *Gold Standard Safe Harbor* model for traditional vulnerability research. Under the framework, participating organizations can publicly signal adoption (e.g., via a profile “banner”) and commit to specific protections, including **refraining from legal action**, offering limited exemptions from restrictive terms of service, and supporting researchers if third parties pursue claims tied to authorized research. HackerOne leadership argued that AI testing can involve techniques and outcomes that do not fit neatly into conventional vulnerability disclosure norms, making a dedicated safe-harbor approach necessary to accelerate identification and remediation of AI-related risks across products and services.
Jun 29, 2026
Microsoft, Google, and xAI agreed to give the U.S. Commerce Department pre-release access to frontier AI models so the government can test them for national security and public safety risks before broader deployment. The evaluations will be led by the Center for AI Standards and Innovation (**CAISI**), housed within **NIST**, and will examine threats including AI-enabled cyberattacks, biosecurity concerns, chemical-weapons misuse, and other criminal abuse. Officials said the models will be assessed in classified environments, with some testing designed to study systems whose safeguards have been reduced or removed to better understand unmitigated capabilities and failure modes. The agreements expand earlier voluntary arrangements and align with a broader push for more formal federal oversight of advanced AI, including reported consideration of an executive order establishing government testing protocols before models reach the market. Microsoft said it will also work with CAISI, NIST, and the UK **AI Security Institute** on adversarial assessment methods, safeguard testing, and frontier safety research, while U.S. officials described the effort as part of a wider strategy to measure unexpected behaviors and misuse pathways in powerful models. Industry groups have largely backed the initiative, framing it as a way to improve trust in commercial AI systems while addressing mounting concern over models that could support offensive cyber operations or other high-risk uses.
Jun 29, 2026
The European Commission has unveiled an Action Plan on Cybersecurity and Artificial Intelligence aimed at strengthening cyber resilience while reducing dependence on foreign AI providers. The plan sets out nine measures to widen trusted access to frontier AI models for vetted cybersecurity organizations, improve model evaluation, support vulnerability discovery and coordinated disclosure, and expand AI use in threat detection and incident response. It builds on existing frameworks including **NIS2**, the **Cyber Resilience Act**, and the **AI Act**, and reflects growing concern that advanced AI capabilities critical to cyber defense are concentrated among a small number of mostly non-European vendors. The move comes as security researchers report that both legal exposure and AI access restrictions are hindering good-faith cyber defense work. A recent Lawfare-cited study found researchers in the U.S. and U.K. often abandon projects, limit disclosures, or avoid certain targets because of risks tied to terms of service, the **CFAA**, **DMCA**, **CMA**, defamation, and fraud claims. At the same time, researchers interviewed by TechCrunch said guardrails and vetted-access programs from major AI vendors can block exploit validation, reverse engineering, and vulnerability research, pushing some defenders toward locally run open-source models. OpenAI has separately promoted a trusted-access approach for cyber defense, underscoring a broader policy shift toward controlled but expanded AI availability for legitimate security work.
Jul 24, 2026