New AI Pentesting Certification Launched
TCM Security has launched a new Practical AI Pentest Associate (PAPA) certification. One of the first 100 individuals to pass the exam shared their success, noting the focus on exploiting Agentic AI and Large Language Models (LLMs). The certification represents an emerging trend in specialized credentials beyond foundational ones like Security+ or CEH.
- The Practical AI Pentest Associate (PAPA) exam is a hands-on assessment where students get two full days to perform a penetration test on an AI-based application and an additional two days to compile a professional report. - This certification is geared towards existing penetration testers expanding into AI, developers building AI applications, and blue teamers who assess AI-based risks. - Attack techniques for Agentic AI and LLMs often involve prompt injection, where attackers craft inputs to manipulate the AI's behavior, and memory poisoning, which corrupts the AI's long-term memory to alter its decision-making. - The integration of AI into cybersecurity is expected to create new roles, such as AI security researchers and prompt engineers, while potentially reducing the demand for entry-level positions focused on routine scanning. - For those building foundational knowledge, the CompTIA PenTest+ and EC-Council's Certified Ethical Hacker (CEH) are common entry points, while the Offensive Security Certified Professional (OSCP) is considered a gold standard for its rigorous, 24-hour hands-on exam. - Employers hiring junior penetration testers often look for proficiency with tools like Nmap, Metasploit, and Wireshark, scripting skills in Python or Bash, and a strong grasp of network protocols. - Hands-on practice on platforms like HackTheBox and TryHackMe is essential for developing the practical skills required for certifications and is a key way to demonstrate competence to potential employers. - A critical, and often underrated, skill for penetration testers is the ability to write detailed and professional reports that clearly communicate vulnerabilities and their business impact, a skill directly tested in the PAPA certification format.
