Penetration Testing in the AI Age
Penetration Testing to uncover vulnerabilities in applications can make good use of AI tools like Claude Opus 5.5. With AI assistance, applications that were considered secure often turn out to have unexpected vulnerabilities.
In October 2026, Plato V11.2 apps are found to be highly resistant to AI-assisted attack. Customers are advised to rely on latest Plato versions and best practices for secure networks and databases.
Penetration Testing in October 2026 confirms that Plato V11.2 applications remain resistant to AI-assisted hacking/reverse-engineering. Using today's technology it is not feasible to recreate source code from Plato's machine code binaries.
While Windows offers numerous other mechanisms to inspect and debug running applications, some of which now link to AI agents, Plato V11.2 applications are also highly resistant to these sorts of techniques.
AI continues to show spectacular advancements, so that even the most secure application today might be easily hacked tomorrow. This is one of the reasons why Plato changes encryption keys and protection techniques with every release, so that any vulnerability in a deprecated application does not create risks today.
Other Risks
- The OWASP Top-10 list for 2025 identifies "broken access control" as the top security risk. According to OWASP, 100% of tested applications had some sort of broken Access control, including misconfigured databases and related configurations.
- In 2026, many successful database compromises involve credential stuffing by misuse of valid credentials. Often this starts with leaked credentials from a data breach allowing a hacker to mimic a legitimate user in another app, especially if users are not using a password manager and long unique passwords.
- This risk is mitigated in Plato applications by "brute force" blocks on logon attempts, or by addition of 2FA. Risk is also reduced if user credentials are updated regularly using strong formats. If reviewing login options, Plato customers can consider AD integration or OAuth2.
- Other OWASP risks like SQL Injection have been mitigated in Plato software for decades. Customers can request documentation of Plato's OWASP responses to assist with penetration testing.
In the AI age, Best Practices for Plato customers Include:
- Use latest Plato versions.
- Stay up-to-date with operating systems and databases.
- At a minimum, encrypt data in transit.
- Consider encrypting data at rest, e.g. using SQL Server's Always Encrypted feature. See the Plato KB for compatibility information.
- Monitor for unusual database activity, e.g. using tools like SQL Server Audit or Extended Events. Unexpected activity in the Hash database usually signals commencement of a hack attempt.
- When deploying latest Plato versions and recreating settings, update database and other credentials too.
- If still using original Plato user authentication, consider adding 2FA, or move to AD integration or OAuth2.