Modern web apps are sprawling and increasingly complex, comprising numerous different technologies, frameworks, and microservices. Even for the most seasoned pentesters, it's a constant balancing act between digging deeper and ensuring you've covered the full scope.

Cristi Vlad, a penetration tester and bug bounty hunter based in Romania, has spent the last seven years honing his craft. Originally trained as a civil engineer, he made a career pivot after discovering the thrill of hacking through platforms like VulnHub, HackTheBox, and of course, the Web Security Academy. Today, he runs his own consultancy, delivering high-impact pentests for clients around the globe.

Like any experienced pentester, Cristi has long relied on Burp Suite Professional as his go-to tool for web app and API security testing. Recently, he started using Burp AI to enhance his workflow, and the results have been transformative. Rather than automating his work or replacing his expertise, Burp AI has become a true collaborative assistant, helping Cristi think more broadly, work more efficiently, and even helping him discover critical security vulnerabilities.

More bandwidth, better focus

Thanks to Burp AI, Cristi could:

• Maintain full control over his pentest, while offloading background tasks to AI.
• Stay focused on the highest-value activities that required his human expertise, letting Burp AI pick up the slack and follow other leads on his behalf.
• Expand his situational awareness, leading to a critical vulnerability that might otherwise have been missed.
  

The collaborative approach also reinforced Cristi's enjoyment of testing. "I like that these are AI enhancements to support my workflow, not automate it away," he noted.

I like that these are AI enhancements to support my workflow, not automate it away.

He emphasized that the careful design of Burp AI, respecting user control, privacy, and supplementing, rather than disrupting, his manual workflow, was crucial to earning his trust.

Cristi's experience highlights PortSwigger's vision for Burp AI: augmenting professional testers, not replacing them. Like power tools for carpenters, Burp AI is designed to let skilled security researchers do more, think faster, and achieve greater results, while keeping the human expert firmly in the driver's seat.

Addressing the skeptics

Cristi is candid about the skepticism he sees in the industry. Some pentesters worry about AI replacing them, or at least diluting their value. But he doesn't see this as a real concern.

"I don't think the technology is capable of fully automating pentesting yet, but it has huge potential."

I'm really pleased that you're implementing Burp AI as a helpful assistant designed to support me with the things I'm already doing.

"I'm really pleased with how you're approaching it in Burp Suite, by implementing Burp AI as a helpful assistant designed to support me with the things I'm already doing."

Some simply dismiss AI features as gimmicks outright, insisting their own knowledge and experience are already vastly superior to anything AI is capable of. But Cristi encourages them to try Burp AI with an open mind.

"When you have a fixed methodology or a workflow, the human tendency is to stick to it because it's comfortable. But I think that's to your own detriment," he explains, "I think as these features mature, they'll help people break that cycle and think a bit more outside of their comfort zone."

No more near misses

Cristi describes how, like many pentesters, he often wonders about vulnerabilities he may have missed out on or overlooked in the past. He's excited to see how Burp AI can help him avoid these cases going forward.

It's invaluable because nobody knows everything. It's delusional to think you do, no matter how much experience you have.

"I like the fact that AI could bring to my attention additional attack vectors or issues that I might've missed otherwise due to not being as familiar with that particular vulnerability class or technology. That's invaluable because nobody knows everything. It's delusional to think you do, no matter how much experience you have."

Burp AI's unique advantages

He also points out that integrating AI directly into Burp Suite has some unique advantages.
"Even if you have an advanced model, you also need to provide it with the relevant context."

No other tool is capable of providing this sort of granular, organized context to the AI.

"Given that Burp Suite is a sort of 'X-ray' for studying an application, no other tool is capable of providing this sort of granular, organized context to the AI."

Privacy and trust

While naturally careful with his clients' sensitive data, he doesn't have an issue with Burp AI relying on third-party models.

"PortSwigger has zero-retention agreements with all of the model providers, so I'm not concerned about that side of things. And besides, you're constantly interacting with sensitive data and functionality during a pentest, regardless of whether you're using AI features or not. Being mindful about what you're doing and what the implications might be is just part of being a pentester; it's not a new issue that's been introduced by AI specifically."

Experience Burp AI for yourself

Cristi’s story isn’t unique. It’s just the beginning of what’s possible when AI and human expertise work together. If you’re ready to spend less time on tedious validation and more time on creative hacking, give Burp AI a try.

Every Burp Suite Professional user gets 10,000 free AI credits to experiment with. No gimmicks. No nonsense. Just practical, privacy-respecting assistance that fits seamlessly into your existing workflow.

Upgrade to the latest version of Burp Suite Professional and start exploring with Burp AI today.