SECUTE 2026

Jürgen Cito | TU Wien, Austria
Bio

Large language models (LLMs) have recently shown unexpectedly strong performance in offensive security tasks. In this talk, I present our work demonstrating their effectiveness in concrete scenarios such as privilege escalation and attacks on enterprise networks (e.g., Active Directory environments). To explain these results, we hypothesize why LLMs perform well in this domain and relate these hypotheses to our empirical study of how human penetration testers reason and operate in practice. Finally, I want to discuss the ethical dimension of automated penetration testing: Dual-use concerns have always been central to security research, but become more acute with increasing levels of autonomy. We examine how these concerns manifest in the context of LLM-based penetration testing, including questions around responsible disclosure, access, and the broader implications of commoditizing offensive capabilities.