How a Penetration Test Builds Customer Trust & Strengthens ISO 42001 Certification
Penetration Testing | Artificial Intelligence | ISO 42001
Published: Nov 3, 2025
Not only is artificial intelligence changing how businesses operate; it's also changing how cybercriminals attack. As organizations rush to adopt AI systems, they face new security risks that traditional defenses can't handle.
ISO 42001 compliance is instrumental in helping your organization manage AI responsibly, but certification alone isn't always enough to effectively strengthen your security posture. A penetration test reveals the security gaps that an audit might miss. Together, these initiatives create a defense strategy that builds customer trust and protects your business from all angles.
As the first ISO 42001 certification body accredited by ANAB and experienced penetration testing providers, we understand the true value of consolidating both security services. In this article, we’ll explore how AI has increased security risks and why they are harder to respond to, how penetration testing can address those risks, and its overall relation to ISO 42001.
How AI Has Become a Weapon
Cybercriminals use AI to scale their operations in many ways. Chatbots now write phishing emails in multiple languages. Machine learning finds weak spots in networks faster than human hackers ever could. Deepfake videos and voices trick employees into transferring money or sharing passwords. For example, in 2024, a deepfake of a CEO's voice was used to steal $25 million from a company.
The threat even extends to AI systems themselves, as criminals poison training data to make AI models behave incorrectly, Prompt injection attacks force chatbots to reveal sensitive information, and data extraction attacks can even steal entire AI models.
Why AI-Powered Attacks Are Harder to Stop
Traditional security tools fail to address AI attacks for several reasons. Most notably, these attacks adapt and learn from your defenses. When one approach fails, the AI system tries another method automatically.
Speed creates another problem. A human might send 10-20 targeted phishing emails per day. Whereas an AI system can research organizations, build email pretexts with no spelling or grammatical errors, then spin up infrastructure to send 100,000 personalized and targeted emails at the same time. Your security team can't keep up with that volume or sophistication.
The attacks even look legitimate, and AI-generated content passes basic security filters. Email systems that block spam might let through AI-written messages that seem authentic.
New Threats in Agentic AI Frameworks
Agentic AI frameworks present different security challenges altogether. These systems act as agents, use tools, and connect to external services automatically, making decisions and taking actions without needing human approval.
Many agentic frameworks use the Model Context Protocol (MCP) to connect AI models with external tools. MCP servers access databases, APIs, and cloud services on behalf of AI agents, resulting in the creation of attack surfaces that traditional security tools don't cover.
Attackers exploit MCP servers through several methods. Server-side request forgery attacks can steal OAuth tokens, and prompt injections can convince AI agents to access restricted tools or data.
The complexity of agentic systems makes security harder. For example, an AI agent might chain together multiple tools to complete a task and when any tool in that chain has vulnerabilities, the entire system becomes compromised.
MCP-Specific Security Risks
Model Context Protocol implementations face specific security challenges. MCP servers often run with elevated privileges to access multiple backend systems and once compromised, attackers gain access to all connected services.
Authentication in MCP systems can be complex. Many implementations reuse OAuth credentials across different components, which breaks security isolation and creates single points of failure.
MCP servers also handle dynamic tool resolution. Attackers manipulate this process to access unauthorized tools or escalate privileges, making protocol flexibility a security weakness when not properly controlled.
Memory safety issues affect MCP implementations as well. Malicious payloads might claim larger sizes than actual content, causing servers to pre-allocate excessive memory. This leads to denial-of-service attacks.
How Penetration Testing Addresses AI Related Risks
Traditional penetration testing approaches need to be updated in order to address agentic AI systems. Testers must now understand how AI agents make decisions and which tools they can access.
For MCP security, penetration testing starts with protocol inspection, during which our team examines the handshake process to understand what tools and resources the server provides. This gives a clear picture of the attack surface.
Local MCP server testing reveals privilege escalation opportunities. Since these servers often run with different permission levels, they create pathways for attackers to gain higher access.
Penetration testing validates tool isolation as testers check whether compromising one MCP tool leads to access in other connected systems. This matters because agentic systems often chain multiple tools together.
How Penetration Testing Strengthens MCP Server Security
The introduction of MCP servers changes how risk moves through an environment. Common MCP vulnerabilities such as prompt injection, context leakage, instruction override, and weak token handling show up often in deployments. They can expose internal systems such as APIs, databases, and cloud services and just one misstep inside the MCP layer can quickly turn into a wider compromise.
Penetration testing identifies what those flaws mean in practice because we look at your MCP deployment the way an attacker would. We assess considerations like if tokens can be reused, if a crafted input can convince the agent to break its own rules, or if the server can be pushed into exposing systems it should never reach. Instead of stopping at theory, we show how far an attacker could actually get and what changes when a server is exploited.
MCP security depends on strong operational practices. Pinning and signing updates prevent servers from being silently replaced and strict token scopes and audience validation limit what stolen credentials can do. Isolating MCP components reduces the spread of a compromise and network allow-lists keep servers from reaching where they shouldn't. When combined with pen testing, these practices help you see both sides, giving you a full picture of risk and a clear path to reducing it.
Our testing shows how attackers might approach your environment, and our guidance connects that to the best practices that keep MCP servers secure. The result is confidence that your deployment is not only functional but resilient against threats.
What Penetration Testing Does for ISO 42001
ISO 42001 requires organizations to identify and manage AI risks, covering governance, risk management, and impact assessments. But how do you know whether your defenses actually work?
A penetration test fills this gap by simulating attacks against your AI systems. Testers try to exploit the same vulnerabilities that criminals would target, revealing problems that paper audits can't find.
For agentic AI systems, testing becomes more complex. Testers must understand how AI agents interact with MCP servers and external tools to check whether agents can be tricked into performing unauthorized actions.
The test also validates your AI supply chain security. Many organizations use third-party AI services or pre-trained models, and a penetration test checks whether these dependencies create security gaps.
How Penetration Testing Reduces Risk
Penetration testing reduces AI risks in several ways. First, it finds vulnerabilities before criminals do, enabling you to proactively fix problems on your own timeline instead of responding to an emergency retroactively.
For MCP implementations, testing reveals configuration issues that could lead to privilege escalation, checking whether authentication systems properly isolate different components.
Testing also validates your security controls. Your firewall might block traditional attacks but fail against AI-specific threats. A penetration test reveals these blind spots.
The process helps your team understand new threat patterns as they evolve. Most IT staff learned security before agentic AI systems existed, but penetration testing shows them what these threats look like today.
The Risk of Skipping Penetration Testing
Even organizations with robust security postures who skip penetration testing face several risks because they might have security gaps they don't know about. For example, a data breach could expose customer information or trade secrets.
For agentic AI systems, the risks multiply. A compromised AI agent might take actions that seem legitimate but cause damage. It could transfer money, delete data, or leak sensitive information to competitors.
Failed AI systems can also make decisions that harm customers. Consider an AI loan system that gets poisoned to discriminate against certain groups, the legal and reputation costs could be irreparable.
Without testing, you can't prove whether your security works, but that validation is crucial as customers and partners want evidence that you protect their data. ISO 42001 certification shows you have processes, and penetration testing proves those processes work effectively.
How Schellman Streamlines ISO 42001 and Pen Testing
Schellman consolidates ISO 42001 audits with penetration testing in one process, saving time and money while providing better results.
Our team understands both compliance and security testing, allowing us to identify areas where penetration testing should focus on based on your ISO 42001 implementation. This targeted approach results in more issues being identified in less time.
We remain current with emerging AI technologies like agentic frameworks and MCP implementations, and we prioritize evolving our testing methodology as new features arise to address new attack vectors.
We coordinate timing between services, so instead of separate engagements being held months apart, we align both processes at once. You get comprehensive results faster with less disruption to your business.
Building Trust Through Security
Customer trust depends on security. ISO 42001 certification shows you care about AI governance while penetration testing really validates that it works.
As AI systems become more autonomous and connected, the security stakes continue to grow. Agentic AI frameworks and MCP implementations create new opportunities for attackers, and only thorough testing can reveal whether your defenses will hold up.
Together, these services create a foundation for responsible AI use. You can confidently deploy AI systems knowing they're both compliant and secure, and your customers can trust that their data stays protected.
To learn more about Schellman’s penetration testing or ISO 42001 services, contact us today. In the meantime, discover other helpful insights in these additional resources:
About Josh Tomkiel
Josh Tomkiel is a Managing Director on Schellman’s Penetration Testing Team based in the Greater Philadelphia area with over a decade of experience within the Information Security field. He has a deep background in all facets of penetration testing and works closely with all of Schellman's service lines to ensure that any penetration testing requirements are met. Having been a penetration tester himself, he knows what it takes to have a successful assessment. Additionally, Josh understands the importance of a positive client experience and takes great care to ensure that expectations are not only met but exceeded.