Impacto de la inteligencia artificial en el Pentesting Empresarial, análisis mediante técnicas de ingeniería social y herramientas generativas

Abstract

The increasing sophistication of cyberattacks and their social engineering and ransomware variants has made it imperative to review organizational cyber defenses. Therefore, this research investigates the effect of using generative artificial intelligence tools, such as ChatGPT, in penetration tests focused on exploiting human vulnerabilities. This case study was conducted with the company Casystem, located in Cuenca, Ecuador, by comparing two groups of simulated phishing campaigns: one traditional and one assisted by artificial intelligence. A mixed-method approach was applied with quantitative and qualitative analysis focusing on click-through rate, credential presentation, response time, and human risk index (HRI) metrics. The results show that in the AI-assisted campaign the human risk index (HRI) was 53.3% while the traditional approach yielded 13.3% illustrating that AI-generated content was much more persuasive. Ethical and legal risks were also observed arising from the unregulated corporate framework in the use of these tools.