UK Firms Rush to Certify AI Cybersecurity Tools

Britain's cybersecurity industry is undergoing a rapid transformation as firms race to harness artificial intelligence in the fight against a new generation of AI-powered cyberattacks. This week, industry accreditation body CREST confirmed its first cohort of ten officially certified providers offering AI-enabled penetration testing, marking one of the clearest signs yet that the sector is moving to formalise standards around a fast-growing but largely unregulated corner of the market.

A booming corner of the tech sector

According to the UK government's most recent Cyber Security Sectoral Analysis, 111 British firms are now offering cybersecurity services specifically tailored to AI systems — a rise of 68 per cent compared with the previous year's baseline. Within that group, around a fifth are offering dedicated AI red teaming and penetration testing services, reflecting surging demand from organisations keen to understand how vulnerable their own AI deployments might be to attack.

CREST's new accreditation scheme is designed to bring some order to that growth. Rather than simply certifying that a firm uses AI tools, the standard examines how companies actually deploy artificial intelligence during security testing, looking closely at governance structures, human oversight arrangements and professional accountability. Industry figures say the move reflects growing recognition that AI-assisted testing, if poorly governed, could introduce as many risks as it resolves.

Why the threat landscape is changing so fast

The push for tighter standards comes against a backdrop of mounting concern about how artificial intelligence is reshaping the offensive side of cybersecurity too. Regulators and government officials have repeatedly warned this year that increasingly capable AI models are lowering the barrier to sophisticated attacks, potentially enabling malicious actors to identify and exploit software vulnerabilities far more quickly than was previously possible.

Ministers issued an open letter to UK business leaders back in April warning that AI-driven cyberattacks are likely to grow more advanced through the remainder of 2026 and beyond, urging companies — particularly smaller firms without dedicated in-house security teams — to treat cyber resilience as a core part of running a modern business rather than an afterthought. That warning has since fed into wider government efforts, including the Cyber Security and Resilience Bill currently progressing through Parliament, which aims to strengthen protections for critical national infrastructure such as the NHS and energy networks.

Regulators keeping close watch

Communications regulator Ofcom has also been closely tracking the issue, having written to telecoms providers earlier this year to flag the cybersecurity implications of increasingly capable frontier AI models. The regulator has coordinated with the National Cyber Security Centre and the UK's AI Security Institute to brief industry stakeholders on the risks, and is currently examining whether existing telecoms security regulations might be inadvertently slowing the adoption of effective AI-driven defensive tools.

That balancing act — encouraging the benefits of AI-powered defence while managing the risks of AI-powered attack — sits at the heart of much of the current policy debate. Industry advocates argue that overly cautious regulation could leave UK firms lagging behind international competitors, while security experts caution that moving too quickly without proper safeguards risks embedding new vulnerabilities into critical systems.

What it means for UK businesses

For organisations across the country, the immediate takeaway is a practical one: cybersecurity is no longer a static discipline that can be reviewed annually and left largely untouched. With attackers increasingly experimenting with AI-assisted techniques, businesses are being encouraged to work with accredited providers who can demonstrate both technical competence and proper governance around how they use AI tools during testing.

The emergence of formal accreditation schemes such as CREST's new AI penetration testing standard offers a useful signal for businesses trying to navigate an increasingly crowded and fast-moving market. As the sector matures, further standards and guidance are expected to follow, particularly as government legislation on critical infrastructure security continues its passage through Parliament in the months ahead.