Penetration testing: Taxonomies, trade-offs, and adaptive strategies

Abstract

Modern cybersecurity faces increasing complexity due to the growth of cloud-native platforms, legacy systems, and the proliferation of IoT devices. Traditional penetration testing methods, such as manual exploits and signature-based scanners, offer precision, but lack scalability and adaptability. Conversely, AI-based approaches, which employ techniques such as machine learning, reinforcement learning, and large language models to automate specific phases of the penetration testing workflow, introduce adaptability but also face significant challenges, including data dependency, limited interpretability, and high computational cost. This review focuses on three core questions: the comparative strengths and weaknesses of conventional and AI-based penetration testing, the influence of deployment contexts such as cloud and IoT, and how hybrid strategies can balance automation with human oversight. In this review, we focus mainly on the literature from 2010 to 2025, with inclusion criteria based on empirical validation, relevance, and impact. We conclude by proposing a research agenda focused on explainable AI, efficient model deployment, and standardized evaluation benchmarks for next-generation penetration testing systems.