AI Penetration Testing: UMBRA, AI-Powered Detection Validated by Experts

Tableau de bord de sécurité affichant les statuts : Réseaux sécurisés, sans virus et applications à jour.

With HackHeart, we’ve joined forces to create and present Umbra to you.

The AI penetration testing market expanded significantly in 2025–2026, with a proliferation of offerings ranging from simple automated scans to advanced agent-based platforms. Between the two, there was a real gap: on the one hand, quick and inexpensive scans whose results remain unverified, riddled with false positives, and lacking any understanding of the actual business logic of the system being tested; on the other, entirely manual penetration tests—rigorous but whose cost and time requirements limit how often a company can conduct them. UMBRA, the tool we developed, was created to fill precisely this gap: neither just another automated scan nor an exclusively manual penetration test, but a method that combines the two in a structured way.

How UMBRA Works: The AI Penetration Testing Methodology

LThe principle is simple to state but challenging to maintain over time: UMBRA examines the system being tested using the six-step methodology we apply to every AI penetration test, reconnaissance, initial access, MCP connector security, AI-generated code supply chain, and internal infrastructure exploitation—and identifies potential vulnerabilities encountered at each stage. Each result generated by UMBRA is then systematically verified manually by one of our experts before being considered confirmed and included in the final report delivered to the client.

This human validation step is neither an option nor a guarantee tacked on as a marketing gimmick: it is what structurally sets UMBRA apart from a scanning tool. An automated scan stops upon detecting a known pattern; UMBRA goes further by actively exploring the system’s surface, but deliberately stops short of certifying a result, which remains entirely the responsibility of a human tester. AI expands and accelerates test coverage; it never replaces the judgment required to determine whether a detected vulnerability is actually exploitable in the specific context of the audited architecture.

Why does an effective AI penetration test require human validation?

The reason why fully automated validation remains insufficient today is that validating the actual impact of a vulnerability and interpreting the results within the client’s business context still require human expertise—it is not a task that can be fully automated at this stage of market maturity. A model may flag a plausible anomaly without having the organizational context (the system’s actual criticality, the sensitivity of the data involved, and the client’s risk tolerance)—which is the only way to determine whether this anomaly warrants urgent remediation or simply needs to be monitored.

This limitation is not unique to UMBRA: it affects the entire industry, and the rapid blurring of the line between testing tools and human testers reinforces—rather than weakens—the need for a final human review. It is this design choice—made from the very beginning of the product’s development—that explains why UMBRA was never intended to replace our experts, but rather to amplify their ability to tackle the most time-consuming and repetitive part of the work: the initial exploration of a surface area under attack.

The Benefits of a Hybrid AI Penetration Test for Your Security

More penetration tests can be conducted: by completing the initial reconnaissance and detection phase more quickly, UMBRA frees up expert time for validation and in-depth analysis, allowing more assignments to be carried out within the same time frame.

Lower costs for businesses: This efficiency is directly reflected in the pricing offered to customers, making a rigorous AI-powered penetration test accessible to organizations that might not otherwise have the budget for a fully manual process.

No compromises on the reliability of results: every vulnerability listed in a UMBRA report has been verified by a human, which eliminates the risk of false positives that is common with automated scanning tools that are delivered without validation.

Coverage tailored to the actual architecture: UMBRA follows the same six-step methodology as our manual penetration tests, adapted to whether or not RAGs, agents, or MCP connectors are present in the system under test, rather than a generic list of malicious prompts applied indiscriminately.

FAQ: Everything You Need to Know About AI Penetration Testing with UMBRA

Does UMBRA replace a penetration test conducted by a human expert?

No. UMBRA speeds up the detection phase, but each result is verified manually before being delivered. It is this systematic verification—not automation alone—that ensures the reliability of the final report.

What is the difference between UMBRA and a traditional vulnerability scan?

A standard scan produces a list of raw results, often riddled with false positives, without validation or context. UMBRA combines the same speed of detection with systematic human validation that confirms the validity and exploitability of each vulnerability before reporting it.

Is UMBRA suitable for all types of AI systems?

UMBRA follows a six-step methodology applied to all of our AI penetration tests, with the scope tailored depending on whether the system under test includes a RAG, autonomous agents, or MCP connectors—the same calibration approach as a fully manual penetration test.

Launch your next AI penetration test with UMBRA

Our experts will walk you through how UMBRA works and work with you to determine whether it meets your testing needs. Learn more about ourAI audit service for the preliminary scoping phase.