CREST International has launched a new “Security Testing of AI” standard and accreditation aimed at helping organisations identify cybersecurity providers that can assess the security of generative AI and large language model (LLM)-enabled systems.
The not-for-profit accreditation body said the standard is intended to provide independent assurance that service providers have the capability to test AI systems, as more organisations move AI from pilot projects into production use across applications, workflows and business processes.
CREST said the accreditation assesses whether providers have appropriate technical expertise and practitioner competence, testing methodologies, governance and quality controls, technical approaches and tooling, processes for identifying and evaluating AI-specific security risks, and evidence to support conclusions reached during testing.
According to CREST, the accreditation is designed to support procurement and supplier due diligence by reducing reliance on unverified claims about AI security testing capability.
Nick Benson, CEO of CREST, said: “Offering ” Security testing of AI systems” and demonstrating the ability to deliver it effectively are two different things. Buyers need to know that the providers assessing their AI have the right expertise and methodologies.”
CREST said the standard is based on the principle that AI security testing should consider the whole system, rather than focusing only on the underlying model. It said testing should also include applications, prompts and system instructions, retrieval mechanisms, data sources, memory, tools, plugins, APIs, orchestration layers and downstream systems influenced by AI outputs.
The launch follows CREST’s broader AI assurance programme. CREST cited research indicating that 69% of penetration testing providers already use AI and 76% have increased their usage over the past year. In July, CREST announced an AI-Enabled Penetration Testing standard focused on how providers use AI in the delivery of penetration testing services, while the new accreditation is intended to assess providers’ capability to test AI systems.
Tim Reed, Technical Director at Sentrium Security Limited, said: “CREST’s standards turn responsible AI from a promise into something that can be evidenced and assessed. We believe this will strengthen buyer confidence, reward credible providers and set a higher bar for the profession, which is why we intend to pursue accreditation.”
Yann Chalençon, Head of Cyber Security Services at wizlynx group, said: “CREST’s new standard provides a clear, independently verified framework that will help create consistency, strengthen assurance and build trust in both the testing process and the wider use of AI-enabled cybersecurity services.”
CREST said the new accreditation was developed with industry through its AI Working Group and builds on CREST’s Penetration Testing Accreditation, which organisations must hold or apply for alongside it. CREST members and other cybersecurity service providers can apply for the accreditation.
