Capture The Bug wins CREST AI security testing accolade

Capture The Bug has become one of the first four organisations globally to achieve CREST's Security Testing of AI accreditation, placing the New Zealand-founded company in the inaugural group recognised under the new scheme.

CREST introduced the accreditation as a benchmark for cybersecurity providers that test artificial intelligence systems, including generative AI applications, large language model-enabled tools and AI agents. Capture The Bug joins Cyberis Reply and CyberLab from the United Kingdom, and Swarmnetics from Singapore, in the first cohort.

The recognition comes as AI use rises sharply among New Zealand businesses and security concerns extend beyond conventional software testing. Datacom's 2026 State of AI Index found that 91% of surveyed New Zealand organisations were using some form of AI, up from 66% in 2024, while 13% were using agentic or autonomous AI systems.

That growth has drawn scrutiny from security officials. In its 2026 Cyber Threat Report, New Zealand's National Cyber Security Centre said artificial intelligence is reshaping the cybersecurity landscape, adding pressure on business leaders to understand how AI systems handle sensitive information and connect with wider corporate networks.

New risks

Security concerns linked to AI differ in several ways from those associated with traditional applications. Risks include prompt injection attacks designed to alter a system's behaviour, exposure of sensitive data, excessive permissions granted to AI agents, and weaknesses in the links between AI tools and other systems.

These issues can become more serious when AI agents are allowed to retrieve information, call application programming interfaces, or take actions through connected tools. In those settings, a manipulated AI system may do more than produce a misleading response: it may also interact with confidential data or operational systems.

That has increased demand for specialist testing that assesses the full application environment rather than only the underlying model. The CREST framework evaluates technical expertise, testing methodologies, governance, quality controls and evidence-based reporting.

The accreditation also distinguishes between testing AI systems used by clients and the separate question of whether a cybersecurity provider uses AI in its own work. CREST's Security Testing of AI scheme focuses on the former, while its AI-Enabled Penetration Testing accreditation covers the latter.

Market signal

For buyers of security services, that distinction may matter as more vendors market AI-related expertise. Independent accreditation gives organisations another reference point when deciding whether a provider has the specialist skills needed to assess newer technologies.

The latest recognition builds on Capture The Bug's existing CREST Penetration Testing accreditation. The Auckland-founded company provides penetration testing services for web applications, APIs, mobile applications, infrastructure and AI-enabled systems across New Zealand, Australia and other markets.

Its model combines specialist testing with a platform designed to give engineering and security teams visibility of findings, support remediation and allow retesting as software changes. That reflects a wider shift in cybersecurity services as customers move away from periodic assessments towards testing that fits continuous software development and release cycles.

AI systems add another layer to that shift. As businesses embed AI into customer-facing services and internal operations, security teams increasingly need to know not only whether a model can be attacked, but also what happens when it is connected to data stores, workflows and external tools.

Ankita Dhakar, Founder and Chief Executive Officer, Capture The Bug, said: "The real test of AI security isn't just what a system is designed to do, but what someone can manipulate it into doing. As AI becomes embedded in business-critical systems, independent, real-world security testing is essential to building trust. We're proud to be recognised by CREST and to contribute to raising the standard of AI security assurance."

Broader context

The company's inclusion in the first group recognised under the scheme gives New Zealand a place in an area of cybersecurity likely to grow in importance as AI adoption becomes more widespread. It also signals that the market for AI assurance is starting to formalise through external standards rather than vendor claims alone.

Even so, accrediting a provider does not mean the AI systems it tests are inherently secure. Security outcomes still depend on the quality of the assessment, the steps taken to fix weaknesses and the oversight that follows deployment.

For companies building or deploying AI-enabled products, the main challenge is likely to be practical rather than theoretical. They must determine how systems respond to adversarial inputs, whether access controls work as intended, and how failures in connected systems could affect day-to-day operations.

Capture The Bug's accreditation places it among a small initial group of providers assessed against the emerging standard, at a time when AI security testing is moving from a niche specialism towards a more defined part of the cybersecurity market.