Capture The Bug Becomes One of the First Four Companies Worldwide to Achieve CREST Security Testing of AI Accreditation

Why AI Security Needs a Different Approach

AI is no longer confined to experiments or internal productivity tools. It is becoming part of customer-facing applications, enterprise workflows and business-critical systems.

From AI-powered assistants and copilots to autonomous agents connected to APIs and sensitive business data, organisations are introducing new capabilities at an extraordinary pace.

But these systems also introduce security risks that conventional penetration testing may not fully address.

An AI application might appear to work exactly as intended under normal conditions. The real question is what happens when someone deliberately manipulates its behaviour.

Can an attacker trick an assistant into disclosing information it shouldn't access? Can malicious instructions influence an AI agent into executing an unauthorised action? Could a connected tool or integration expose sensitive business data?

These are the questions specialist AI security testing must answer.

What Is CREST's Security Testing of AI Accreditation?

CREST is a globally recognised, not-for-profit cybersecurity accreditation body that independently assesses organisations against established standards for security testing.

Its new Security Testing of AI accreditation, launched in August 2026, recognises cybersecurity providers that demonstrate the specialist capability required to assess generative AI and large language model (LLM)-enabled systems.

Unlike a self-declared capability or a voluntary commitment, the accreditation involves independent assessment of a provider's:

• Technical competence and specialist expertise
• AI security testing methodologies
• Governance and quality assurance controls
• Evidence-based testing and reporting capabilities

Importantly, CREST takes a system-wide approach.

Testing is not limited to the underlying AI model. It also considers the applications, data sources, retrieval mechanisms, connected tools, APIs and workflows surrounding it.

The accreditation builds upon CREST's existing Penetration Testing Accreditation, establishing additional requirements for providers assessing AI-enabled technologies.

What This Means for Organisations Building AI

For businesses introducing AI into their products and operations, selecting a capable security testing provider is becoming increasingly important.

Our accreditation provides an independent benchmark of our capability, while our expert-led penetration testing and PTaaS platform help organisations identify, understand and address security risks.

Specialist Testing Beyond the AI Model

Our AI penetration testing assesses real-world attack scenarios, including:

• Prompt injection and jailbreaks: Attempts to manipulate AI instructions, behaviour and intended restrictions.
• Sensitive data exposure: Risks involving confidential information, customer records and unauthorised data access.
• AI agent and tool misuse: Whether connected agents can be manipulated into performing unintended or unauthorised actions.
• Insecure integrations: Weaknesses across APIs, retrieval systems, applications and connected services.
• AI-specific vulnerabilities: Risks aligned with recognised guidance, including the OWASP Top 10 for LLM Applications.

The objective is not simply to identify weaknesses in a model. It is to understand how those weaknesses could create exploitable risks across the wider system.

Human-Led Testing, Supported by Our PTaaS Platform

At Capture The Bug, specialist security testing and technology work together.

Our security consultants conduct adversarial testing to identify and validate risks, while our Penetration Testing as a Service (PTaaS) platform provides customers with visibility throughout the engagement.

This includes:

• Validated findings made available through a live dashboard
• Clear risk prioritisation and actionable remediation guidance
• Direct collaboration with security specialists
• Retesting to verify remediation
• Testing programmes that can evolve alongside product development

For engineering teams shipping AI capabilities regularly, this approach helps make security testing part of an ongoing risk-reduction programme rather than an isolated compliance exercise.

Independent Accreditation. Practical Security Assurance.

There is an important distinction worth making.

CREST's Security Testing of AI accreditation validates the capability of the testing provider. It does not certify that an individual customer's AI system is secure.

Security assurance still requires appropriate scoping, rigorous testing, validated findings and remediation.

What the accreditation offers is independent confidence that the organisation conducting that assessment has demonstrated the necessary technical expertise, methodology and quality controls.

For security leaders, technology teams and enterprise buyers, that is an important distinction when evaluating who to trust with increasingly complex AI environments.

A Proud Milestone for Our Team and New Zealand

Capture The Bug was built around a simple belief: security testing should be technically rigorous, collaborative and accessible to businesses as their technology evolves.

As a CREST-accredited penetration testing provider and founding signatory of CREST's AI Charter, we have continued to invest in specialist testing capabilities and the platform that supports our customers.

Achieving this new accreditation is another important step in that journey.

We are particularly proud to represent New Zealand in the first global cohort, alongside established cybersecurity organisations from the UK and Singapore.

Our thanks go to our penetration testing team for the expertise and dedication behind this achievement, and to CREST for developing independent standards that strengthen confidence in an emerging area of cybersecurity.

Congratulations also to Cyberis, CyberLab and Swarmnetics on achieving this milestone.

You can read CREST's official announcement for more information.

Is Your AI System Ready for Real-World Security Testing?

If your organisation is developing AI-powered applications, copilots, LLM integrations or autonomous agents, understanding their security risks before and after deployment is essential.

Start by examining what your AI can access, what actions it can perform and how it behaves when confronted with malicious or unexpected inputs.

Our guide to LLM penetration testing explores the security challenges organisations should consider.

Building or deploying AI? Let's discuss how specialist penetration testing can help you understand and reduce your exposure.