Project ideas from Hacker News discussions.

Comparing AI agents to cybersecurity professionals in real-world pen testing

📝 Discussion Summary (Click to expand)

1. The debate over AI's capability to replace human penetration testers

Discussion participants are divided on whether AI agents like ARTEMIS are truly ready to replace human penetration testers, with some pointing out significant limitations while others see rapid, inevitable progress. Skeptics highlight the high rate of false positives and the AI's failure to spot obvious vulnerabilities as evidence that it is not yet a complete solution. Proponents, however, argue that AI is already superior for routine tasks and will quickly surpass humans in more complex areas.

  • tptacek: "I would expect over the medium term agent platforms to trounce un-augmented human testing teams in basically all the 'routinized' pentesting tasks --- network, web, mobile, source code reviews. There are too many aspects of the work that are just perfect fits for agent loops."
  • Sytten: "The app automated pentest scanners find the bottom 10-20% of vulns, no real pentester would consider them great. Agents might get us to 40%-50% range, what they are really good at is finding 'signals' that the human should investigate."
  • mens_rea: "Deeply flawed paper for several reasons: ... Exaggerated claims (saying A1 beat 50% of testers, yet only 4/10 testers found LESS vulns than A1, and A1 had a nearly 50% false positive rate)."

2. The potential economic impact on the cybersecurity services market

A major theme is the financial pressure AI pentesting will place on the cybersecurity consulting industry, particularly on human billable hours. Even skeptics of the technology's current readiness acknowledge that executive interest in lower-cost AI solutions poses a real threat to traditional service models. Participants discuss how rates have stagnated for years and how AI could accelerate this trend, especially for lower-end, repetitive work.

  • falloutx: "An Exec is gonna read this and start salvating at the idea of replacing security teams."
  • tptacek: "human-in-the-loop AI-mediated pentesting will absolutely slaughter billable hours for offensive security talent."
  • big_youth: "Late-period NCC doesn't look great. But I've been a buyer of these services for the past 5 years... and rates have not gone down; I was shocked at how much we ended up spending compared to what we would have billed out on comparable projects at Matasano... but the high end of the market definitely has not been slaughtered, and I definitely think that is coming."

3. The evolving role of humans in an AI-augmented workflow

There is broad consensus that the role of the human penetration tester will shift, not disappear. Instead of performing repetitive manual checks, humans will act as orchestrators, validators, and interpreters for AI agents. This new model focuses human expertise on higher-level strategy, investigating AI-generated signals, and handling the complex edge cases where current AI struggles.

  • nullcathedral: "The productivity gains from LLMs are real, but not in the 'replace humans' direction. Where they shine is the interpretive grunt work... They're straight up a playing field leveler."
  • KurSix: "The key driver here isn't even model intelligence, but horizontal scaling. A human pentester is constrained by time and attention, whereas an agent can spin up 1,000 parallel sub-agents... Even if the success rate of a single agent attempt is lower than a human's, the sheer volume of attempts more than compensates for it."
  • tptacek: "A pentesting agent directly tests running systems. It's a (much) smarter version of Burp Scanner... Remember, the competition here is against human penetration testers. Humans are extremely lossy testing agents!"

🚀 Project Ideas

LLM-Forensics: Artifact Translator & Context Engine

Summary

  • A specialized workbench for incident responders and forensic investigators to translate "obfuscated blobs" into readable logic.
  • Solves the manual "interpretive grunt work" of reverse engineering binary protocols, minified JS, and assembly during an incident.
  • It provides a "playing field leveler" for security professionals who have a hacker mindset but may not be experts in specific assembly syntaxes or obscure binary formats.

Details

Key Value
Target Audience Incident Responders, Forensic Investigators, Malware Researchers
Core Feature Multi-step "Artifact De-obfuscator" (Bytecode to High-level Pseudo-code)
Tech Stack Python, Ghidra/Frida APIs, LLM Agents (Claude 3.5 Sonnet / GPT-4o)
Difficulty Medium
Monetization Revenue-ready: SaaS subscription or Enterprise on-prem license

Notes

  • Directly addresses the use case mentioned by nullcathedral: "Things that used to mean staring at code for hours... now takes a fraction of the time."
  • Incorporates the cookiengineer observation that LLMs are "very good at translating arbitrary bytecode... to example code" even if not 100% precise.
  • Utility is high because it targets the discovery phase after an incident where speed is critical.

Scaffolder: Multi-Agent Offensive Security Hub

Summary

  • A framework that implements the "Supervisor-Worker-Triager" architecture specifically for offensive security tasks.
  • Solves the problem of LLM "hallucinations" and "memory leaks" by using a structured state knowledge base rather than just a context window.
  • Automates the "checklist" and "rote stuff" of pentesting while allowing humans to steer the high-level strategy.

Details

Key Value
Target Audience Red Teams, Boutique Pentest Firms, Bug Bounty Hunters
Core Feature State-managed agent loops that log attempts in a DB to avoid repeating failed exploits
Tech Stack LangGraph, Python, Metasploit/Burp Suite integration
Difficulty High
Monetization Revenue-ready: Per-engagement licensing (Usage-based credit system)

Notes

  • Based on tptacek's prediction that "80-90% of all findings... are within 12-18 months reach of agent developers."
  • Implements the "Triager" concept discussed by dotty- and scandinavian to verify vulnerabilities and reduce false positives.
  • Appeals to users like zerodayai who recognize that "horizontal scaling" (running 1,000 sub-agents) is an unfair advantage over human attention spans.

Specto: Edge-Case Spec Analyzer

Summary

  • A tool that consumes PDF technical specifications (RFCs, chip datasheets, SVG specs) and compares them against implementation code to find logic gaps.
  • Solves the human limitation of being unable to keep "obscure corners" of massive technical specs in head during a code review.
  • Focuses on "novel vulnerability discovery" by finding implementation deviations from the standard.

Details

Key Value
Target Audience Vulnerability Researchers, Security Auditors, Firmware Engineers
Core Feature PDF-to-Logic Mapping (cross-referencing document specs with source code)
Tech Stack RAG (Retrieval-Augmented Generation) with high-precision PDF parsing
Difficulty Medium
Monetization Hobby (Open Source core) with Premium Managed Cloud

Notes

  • Inspired by viraptor's success: "I found some interesting implementation edge cases just by submitting the source and pdf spec... to Claude."
  • Directly addresses the "deep research" pain point mentioned by nullcathedral regarding obscure specs (like the SVG rendering stack).
  • Provides a bridge for suriya-ganesh's concern about connecting dots across "aberrations" in complex systems.

Read Later