AI pentest vs CREST pentest: which do you need?

CREST is a global accreditation body for cyber security businesses and professionals. According to its website, it serves over 500 member companies worldwide, and its members undergo audit and accreditation processes and sign enforceable codes of conduct and ethics. CREST also certifies individual professionals.

CREST describes penetration testing as evaluating the security of a system or network by simulating an attack, using a variety of manual techniques supported by automated tools, and using the tester's expertise to find specific weaknesses. It notes that penetration testing is often confused with vulnerability assessment.

In practice, a CREST pen test means you hire a member company to test an agreed scope over a set number of days, and receive a formal report. Buyers can find accredited suppliers through the CREST Marketplace.

The value of CREST accreditation is assurance for a third party. When a client or insurer sees a report from a CREST member company, they know the firm has passed an external audit and agreed to a code of conduct. That is why accredited reports are often specified in contracts. The trade-off is cost and timing: engagements are usually booked in advance, run for a fixed number of days and give you a snapshot of your systems at that point.

AI penetration testing uses an AI agent to plan and carry out testing steps. With BreachLine, the agent is Nebula, an AI security testing engineer. See How Nebula works.

Three things change compared with a day-rate engagement:

• Frequency. You can test after each release or fix instead of once a year.
• Retesting. You ask Nebula to verify a fix and it retests. Retests use credits; they are not free.
• Memory. Project memory lets Nebula refer to earlier findings and notes when continuing work.

See What comes as standard. Human sign-off on findings is available when a client requests it.

It is worth being clear about limits. Comparative performance between AI testing and experienced human testers has not been independently established. BreachLine does not claim that Nebula is equivalent to a CREST-accredited test, and Nebula's reports are not CREST reports.

See The problem with testing once a year. You also keep a running record of findings and retests, which helps when a customer questionnaire asks how you test between formal assessments.

You need a CREST report when someone else requires one. Common cases:

• Contracts and tenders. A client, framework or tender names CREST (or the NCSC's CHECK scheme for some public sector work).
• Insurers. Your cyber insurer asks for a test from an accredited provider.
• Regulated work. A regulator or auditor requires testing from an accredited firm.
• Supplier assurance. A large customer's security team will only accept an accredited report.

Grit Consultancy's 2026 guide puts it plainly: only use a CREST-accredited provider if a contract, insurer or regulator asks for it; otherwise it matters less when the test is purely for your own assurance. If you are not sure, ask the party requesting the test what they will accept before you buy anything. Get the answer in writing, including whether a named accreditation, a specific scope or a minimum test date is required. That one email can save you from paying for the wrong kind of test, or from buying an accredited test you did not need.

If you have only been asked for "evidence of security testing", check whether Cyber Essentials or Cyber Essentials Plus would meet the requirement. See Do you need Cyber Essentials as well as a pentest?

Manual testing is priced mainly by consultant day. See our penetration testing cost guide for a wider comparison. BreachLine's plans, as listed on breachline.io/pricing.

Yes, and for many businesses this is the sensible approach. A typical pattern:

1. Commission an accredited test where a contract, insurer or tender needs one, usually once a year.
2. Run AI testing between those tests, so new releases, configuration changes and fixes are checked as they happen.
3. Retest fixes from either report once they are deployed.
4. Go into your next accredited test with fewer known issues, so the testers' days go further.

This keeps your formal evidence in place while reducing the eleven-month gap that a once-a-year test leaves.

A simple way to decide:

• Choose a CREST-accredited test if someone else requires one, or if you need testing that depends heavily on human judgement and context, such as complex internal networks, physical security or social engineering.
• Choose AI pen testing if you want to test more often, check fixes and new releases, and keep costs predictable between formal tests.
• Choose both if you have a formal requirement and systems that change through the year.

Do you need Cyber Essentials as well as a pentest? If you need a scoped assessment rather than the platform, our team can deliver one with an agreed scope and a separate quote.