Christian Biehler
With over a decade of experience in the field, Christian Biehler is a seasoned IT security expert who combines the perspectives of a hacker, penetration tester, consultant, and trainer. His technical focus lies in securing Windows infrastructures and the Microsoft Cloud stack, including Entra ID, Azure, and M365.
Christian holds a Master’s degree in IT Security and the CISSP certification. He has successfully delivered over 300 projects across diverse sectors, establishing deep expertise in security architecture, risk management, and penetration testing for web, mobile, and operating systems.
Since 2019, Christian has been the Managing Director of bi-sec GmbH, leading a firm dedicated to expert consulting, rigorous penetration testing, and specialized security training.
Session
This talk focuses on the opportunities, limitations, and practical results of using AI in penetration testing.
We will compare different approaches to application security testing, including static and dynamic analysis, and examine where AI can provide value in each of them. In particular, we will look at several modes of AI-assisted security testing:
- AI-driven source code analysis
- AI-assisted verification of static analysis tool findings
- AI-driven runtime analysis using custom scripts
- AI-assisted verification of results from established security tools
The effectiveness of these approaches varies significantly depending on the selected method, model, tooling, and target environment.
Instead of relying on idealized lab scenarios, this talk presents real-world results from practical security testing. Beyond classical web application penetration testing, an area where AI already performs comparatively well, we will also explore the use of AI in Active Directory and Windows environment exploitation.
The audience will leave with a realistic understanding of where AI can currently support penetration testers, where it still falls short, and which workflows are most promising in practice.