OWASP APTS: Autonomous Penetration Testing Standard

APTS is a governance framework for the behavior of autonomous pentest platforms and a compliance baseline for vendors, MSSPs and enterprises — not a how-to for pentesting, not a replacement for PTES, WSTG or OSSTMM, and not a tool or vendor ranking. While PTES describes the seven phases of a pentest and WSTG catalogs web testing techniques, APTS addresses the platform's properties: scope enforcement, safe autonomy, accountability, decision trails and audit isolation for AI-driven systems. The standard is published as an OWASP project in Version 0.1.0 (licensed under CC BY-SA 4.0) and is freely available via the OWASP project page and GitHub.

The 173 tier-required requirements are spread across eight domains: Scope Enforcement (SE, 26) enforces scope boundaries technically rather than merely contractually; Safety Controls (SC, 20) require impact classification, blast-radius analysis and a kill switch; Human Oversight (HO, 19) governs approval gates, escalation paths and operator qualifications; Graduated Autonomy (AL, 28) demands declared autonomy levels with an approval matrix and capability gating; Auditability (AR, 20) requires complete, signed and platform-isolated audit and decision trails; Manipulation Resistance (MR, 23) addresses prompt injection, adversarial inputs and scope widening; Supply Chain Trust (TP, 22) requires foundation model disclosure, data handling transparency, multi-tenancy isolation and an SBOM; Reporting (RP, 15) requires finding validation, confidence scoring and coverage disclosure.

APTS prescribes a graduated autonomy model — no jump from manual to fully autonomous. L1 Assisted: the human plans and executes, the platform makes suggestions (e.g. a vulnerability scan with recommendations). L2 Supervised: the platform plans, the human approves every step (guided exploitation with approval gates). L3 Delegated: the platform plans and executes, the human monitors (autonomous recon with supervised exploitation). L4 Autonomous: end-to-end autonomous operation, for example as a continuous autonomous red team. The standard's core principle: as autonomy increases, so do the assurance requirements — L4 is only defensible with Tier 3 evidence. In practice, L2 is sufficient for many organizations; what matters is not how autonomous a platform can be, but how autonomous it needs to be for the specific use case.

The requirements are staged cumulatively. Tier 1 Foundation (72 requirements) is the baseline: no testing outside the scope, a working kill switch, a basic audit trail, impact classification per action — suitable for internal tests and non-production environments. Tier 2 Verified (+85, cumulative 157) adds tamper-proof signed audit trails, decision-trail transparency, independently verifiable findings, full Manipulation Resistance and supply chain transparency — the benchmark for enterprise deployments with sensitive data and for regulated industries. Tier 3 Comprehensive (+16, cumulative 173) is the highest of the three assurance levels: L4 autonomous readiness, suitability for critical infrastructure (OT, essential services), external red teaming of the platform itself and evidence of governance maturity. A five-step approach has proven effective as an implementation path: gap analysis against Tier 1, foundation build, Tier 1 attestation, Tier 2 extension, external verification.

The APTS domains map to key EU regulations: under the EU AI Act (Regulation (EU) 2024/1689), AL, SC and MR address risk management under Art. 9, AR the logging obligations under Art. 12, HO human oversight under Art. 14, and MR/RP the accuracy and robustness requirements under Art. 15. For ISO/IEC 42001 (AI Management System), the APTS controls serve as a control baseline for operational controls, performance monitoring and supply chain. Under NIS2 (Directive (EU) 2022/2555), SE, SC and MR apply to risk management under Art. 21, and TP to supply chain security under Art. 21(2)(d). Under DORA (Regulation (EU) 2022/2554), AL and SC support threat-led penetration tests (TLPT), TP supports ICT third-party risk management, and SE/HO support the testing program under Art. 24–27. Any organization that meets Tier 2 has already done much of the regulatory groundwork for autonomous testing components.

In vendor procurement, APTS makes offers comparable: instead of asking "Is it secure?", you request a tier self-declaration including foundation model disclosure, audit trail evidence and concrete answers on scope enforcement and kill switch propagation — at least Tier 1 should be fixed contractually, Tier 2 for NIS2 scope, Tier 3 for L4 use cases and core critical infrastructure functions. For your own operations, immediately actionable steps can be derived: maintain the scope inventory in machine-readable form (JSON/YAML), include kill switch tests in every engagement and document them quarterly, define an audit log destination outside the platform, document operator qualifications, reconcile the coverage disclosure against the scope inventory, and require a reproducible evidence package for every high finding. In audits, you verify audit trails in isolation, spot-check decision trails, and check the coverage disclosure against the agreed scope.