The Autonomous Testing Governance Framework sets five governed steps for AI-driven security testing: request, approve, scope, execute, and halt and undo. Each step has a control, an owner and the evidence it must leave. It lets security teams adopt autonomous testing and still answer auditors on who approved what.
Autonomy is here. Governance is not.
AI agents can now plan an attack, run it, read the result and try again. That speed is exactly what security teams need. Attackers moved fast first.
Source: Mandiant time-to-exploit analysis, for disclosed vulnerabilities.
So why are so many teams still holding back? Because one question has no good answer yet. Who is accountable when an autonomous agent acts in your environment?
That is not a reason to avoid autonomous testing. It is a reason to govern it.
This framework sets out how. It has five governed steps. Each step has a control, an owner and the evidence it must leave behind. You can adopt it with any tool. We built Hayrok around it.
The framework: five governed steps
Every autonomous test, however small, moves through the same five steps. None can be skipped, and each leaves a record.
Approve
A named owner of the target system signs off, together with security. The approval covers this test, these targets and these techniques. Nothing else.
The approver's name, the scope approved and the time
A prompt is not an approval. An approval names a person, a scope and a time.
Approvals by risk tier
Not every action needs the same sign-off. Reading a public web page is not the same as exploiting a production database. Sort techniques into risk tiers and match each tier to an approver.
| Risk tier | Example actions | Who approves | When |
|---|---|---|---|
TIER 1 · OBSERVE | Discovery, fingerprinting, reading public content | Security lead | Once per test plan |
TIER 2 · PROBE | Authentication tests, non-destructive vulnerability checks | Security lead and system owner | Once per test plan |
TIER 3 · EXPLOIT | Running an exploit, moving laterally, using found credentials | System owner, named per target | Before each technique runs |
TIER 4 · CHANGE | Any action that writes, deletes or changes configuration | System owner and change owner | Before each action, with a rollback plan |
The higher the tier, the closer the approval sits to the action. At tier 3 and above, approval should be given for a specific technique against a specific target, not for the test as a whole.
This is how Hayrok works. It requires human approval before any attack technique runs.
Scope is enforced by the platform, not trusted to the agent
An agent that has been told its scope can still wander. It may follow a link, reuse a credential or reach a host that shares a network with the target. Good intentions in a prompt are not a control.
Scope must be enforced outside the agent, by the platform it runs on.
Governing AI testing is moving fast. Keep up weekly.
The Hayrok Brief covers exploited vulnerabilities, AI security and regulation for security leaders, with what to validate each week.
Design for the bad day: halt and rollback
Sooner or later a test will do something unexpected. A service slows down. An account locks. A record changes. Governance is judged on that day, not on the good ones.
Plan for it before the test starts.
The evidence each step must leave
A log tells you what a tool says happened. Evidence lets someone else check it. Each step of the framework should leave a record that answers four questions.
| Step | Evidence it leaves |
|---|---|
| 01 · Request | The test plan, targets, techniques and risk tier |
| 02 · Approve | The approver's name, the scope approved and the time |
| 03 · Scope | Every blocked attempt, with the target and technique |
| 04 · Execute | Each action, its target, the request and the response |
| 05 · Halt and undo | Who stopped the test, what was reversed, and proof of the prior state |
In Hayrok, Evidence Fabric records these decisions as they happen, and Genesis governs what agents are allowed to do. The aim is simple. When an auditor asks who approved an action, you show them, rather than tell them.
How the framework maps to standards you already use
The framework does not replace your existing controls. It shows how autonomous testing fits inside them.
| Standard | Where the framework fits |
|---|---|
| NIST CSF 2.0 GOVERN FUNCTION | Roles, accountability and oversight for testing activity |
| NIST AI RMF GOVERN AND MANAGE FUNCTIONS | Human oversight of AI systems and how their risks are handled |
| ISO/IEC 27001:2022 ANNEX A 8.32 AND 8.34 | Change management, and protecting systems during audit and testing |
| EU AI Act ARTICLE 14 | The human oversight principle. Article 14 applies to high-risk AI systems, but its approach is a useful model for any autonomous agent |
Check each mapping with your own GRC team. How a control applies depends on your scope and your regulators.
Adopting the framework in 30 days
0 of 4 weeks doneYou do not need a new program. You need four weeks and a few owners.
List the systems you want to test autonomously. Name an owner for each. Agree your risk tiers.
Map each technique to a tier and an approver. Write the kill switch and rollback rules.
Run one governed test on a low-risk system. Check that every step left evidence.
Show the evidence to your GRC lead or auditor. Fix the gaps, then widen the scope.
Frequently asked questions
What is autonomous security testing governance?
It is the set of controls that decide who approves an AI agent's test, what it may touch, how it is stopped, and what evidence it leaves.
Who should approve an autonomous security test?
A named owner of each target system, together with security. Higher-risk actions need approval closer to the moment they run.
Can an AI pentesting agent stay in scope on its own?
It should not be trusted to. Scope should be enforced by the platform, with every blocked attempt recorded.
Is a prompt enough to define scope?
No. A prompt is an instruction to the agent. Scope is a control enforced outside it.
What is a risk tier?
A group of test actions with similar potential impact. Each tier has its own approver and approval timing.
How do you roll back an autonomous test?
Record the prior state before any change, reverse the change, then confirm and record that the system is back to that state.
What evidence do auditors need from autonomous testing?
Who approved each action, what scope was approved, every action taken, every attempt blocked, and how the test ended.
Does the EU AI Act apply to AI pentesting tools?
Article 14 sets human oversight duties for high-risk AI systems. Whether a tool is high-risk depends on its use, so check with counsel. Its oversight approach is a sound model either way.
Can we use this framework with tools other than Hayrok?
Yes. The framework is tool-neutral. Hayrok is built around it.
How long does it take to adopt?
A first governed pilot can run within about four weeks, following the plan above.
There are two ways to work with us.
For security leaders at SaaS, FinTech or cloud platform companies who want to help shape how governed validation works.
Apply to the program →Prove governed validation in your own environment, starting now.
Get early access →At Hayrok Labs we question everything and Validate what matters.
REFERENCES · NIST CSF 2.0, NIST AI RMF, ISO/IEC 27001:2022, EU AI Act, Mandiant time-to-exploit analysis.