CREST Launches Accreditation For Security Testing Of AI Systems

Global cyber security accreditation body, CREST International, has introduced a new standard and accreditation for security testing of AI systems, aimed at giving organisations a way to independently verify that their cyber security providers can actually test generative AI and large language model (LLM)-enabled systems.

The accreditation, called Security Testing of AI, establishes independently assessable requirements for cyber security service providers working with AI systems that have moved beyond experimentation into production environments.

CREST argues that until now, buyers have had no reliable way to determine whether the cyber security providers testing their AI systems have the capability to do so.

What The Accreditation Covers

The standard assesses whether providers have appropriate technical expertise and practitioner competence, testing methodologies, governance and quality controls, technical approaches and tooling, processes for identifying and evaluating AI-specific security risks, and evidence to support the conclusions reached during testing.

Once accredited, providers can offer buyers independent assurance of their AI testing capabilities, which CREST expects will help guide procurement and streamline supplier due diligence.

CEO of CREST, Nick Benson, explained that the accreditation responds to a clear signal from the organisation’s membership.

“Our membership told us very clearly that as their clients deployed AI-enabled tech, they required more information on their AI testing credentials,” Benson noted. “Offering security testing of AI systems and demonstrating the ability to deliver it effectively are two different things.”

“Buyers need to know that the providers assessing their AI have the right expertise and methodologies. Providers now have a way to develop their policies in line with our standard, demonstrate their technical capabilities through independent assessment, giving buyers that all-important confidence to proceed.”

Whole-Of-System Approach

The standard has been designed around the principle that AI security testing needs to consider the whole system, not just the underlying model.

CREST has specified that testing should also take into account applications, prompts and system instructions, retrieval mechanisms, data sources, memory, tools, plugins, APIs, orchestration layers and downstream systems influenced by AI outputs.

The accreditation builds on CREST’s penetration testing accreditation, which organisations must hold or apply for alongside the new AI testing credential.

Part Of A Broader AI Assurance Programme

The Security Testing of AI accreditation is the latest stage of CREST’s growing AI assurance programme. The organisation points to its own research showing that 69 per cent of penetration testing providers already use AI, and 76 per cent have increased their usage over the past year.

In July, CREST launched its AI-Enabled Penetration Testing standard, which focused on how penetration testing providers use AI within the delivery of their services. The new standard differs in that it assures a provider’s capability to test AI systems themselves.

The standards also follow the launch of CREST’s AI Charter and AI Principles in June. More than 100 founding signatory cyber security organisations, representing more than 10 per cent of CREST’s worldwide membership, have committed to supporting the responsible use of AI across industry services.

Industry Reaction

Technical Director at UK-based CREST member, Sentrium Security Limited, Tim Reed, welcomed the standard.

“CREST’s standards turn responsible AI from a promise into something that can be evidenced and assessed,” Reed commented. “We believe this will strengthen buyer confidence, reward credible providers and set a higher bar for the profession, which is why we intend to pursue accreditation.”

Head of Cyber Security Services at Switzerland-based CREST member, wizlynx group, Yann Chalencon, added that the standard provides a clear framework for consistency.

“CREST’s new standard provides a clear, independently verified framework that will help create consistency, strengthen assurance and build trust in both the testing process and the wider use of AI-enabled cybersecurity services,” Chalencon remarked.

CREST developed the standards in collaboration with industry through its AI Working Group and has indicated it will continue to refine them.

Existing CREST members and cyber security service providers can apply for the new accreditation or download the accreditation standards for further information.

Last Updated on September 5, 2026 by Nick Ross