Ethical hacking based on trust tests: a vision oriented to cybersecurity and risk mitigation

Abstract

In the context of growing cybersecurity threats across interconnected sectors, ethical hacking and penetration testing have become essential for protecting sensitive information and critical infrastructure. This systematic review analyzes recent literature on cybersecurity anomalies and identifies the most effective machine learning techniques used in critical domains such as healthcare, finance, and government. The findings reveal that anomalies AN05 and AN08 are among the most frequently reported threats, while techniques T01 and T18 are widely adopted for detecting attack patterns and strengthening cyber defense mechanisms. The review also examines the ethical and legal dimensions of ethical hacking, highlighting the need for sector-specific regulatory frameworks. Additionally, key research gaps are identified, including the lack of standardized trust-testing methodologies, limited transferability of machine learning models, and continued reliance on human expertise. Emerging artificial intelligence technologies offer promising opportunities to improve predictive capabilities, scalability, and cybersecurity resilience across diverse operational environments.

Keywords: ethical hacking, penetration testing, security testing, vulnerability assessment, information security, cybersecurity, cybert threats, phishing

How to cite this article: A. Buitrago-Cadavid, J. Castro-Maldonado, B. Zapata-Baena, R. Urda-Benitez. “Ethical hacking based on trust tests: A vision oriented to cybersecurity and risk mitigation”, Revista Politécnica, vol.22, no.43 pp.62-82, 2026. DOI:10.33571/rpolitec.v22n43a5

1. Introducción

In the digital era, cybersecurity is essential for protecting critical infrastructures and sensitive data. As a result, ethical hacking activities and penetration tests are employed in sectors such as academia, economy, industry, automotive, and healthcare, which face increasing risks due to interconnectivity and the use of the Internet of Things (IoT). It is anticipated that by 2025, the IoT will have an economic impact of $11.1 trillion, with 75 billion connected devices [1]. The advancement of technologies such as artificial intelligence introduces new attack vectors, as phishing techniques have evolved and become more difficult to detect [2]; [3].

To counteract this, PhishStorm is proposed—an automated system that uses URL analysis to identify phishing sites with 96.50% accuracy [4]In the healthcare sector, blockchain frameworks are applied to protect sensitive data, and security architectures complying with standards such as HIPAA and FISMA are utilized [5]. Additionally, advanced techniques for phishing detection have been developed, enhancing security against emerging threats [6]. Furthermore, blockchain technology is being applied across various sectors to improve transparency and security. In the financial industry, it is utilized to optimize transaction execution, as demonstrated by the Interbank Spunta project. In education, it ensures the authenticity of academic certificates, and in healthcare, it securely manages medical data, allowing patients to control their records [7].

In the supply chain, a blockchain-based model has been developed that employs smart contracts on Ethereum to automate transactions, ensuring compliance without intermediaries and improving efficiency through decentralized storage using IPFS. This model includes a reputation system that fosters trust among participants [8]. However, the implementation of disruptive technologies such as the IoT and cloud computing in the manufacturing sector has generated new threats [8], especially in vulnerable sectors like finance and retail, where phishing remains a constant concern. To combat these threats, classification techniques such as Random Forest, Support Vector Machine, and Multilayer Perceptron, among others, are employed [9]. In the defense sector, blockchain and smart contracts are employed to ensure the integrity of transactions [10]. In the realm of IoT, vulnerabilities are detected through machine learning techniques [11].

Phishing is countered using deep learning and algorithms such as MLP [12]; [13], while in corporate networks, deep neural networks are utilized to predict threats. In Industry 4.0, cybersecurity is reinforced with digital twins and honeypots [14]. At the organizational level, insider threats are mitigated by analyzing cyber hygiene and assessing motivations before security is compromised [15]. In the realm of intelligent vehicles, intrusions and spoofing attacks are prevented using deep learning and hybrid techniques that safeguard vehicular networks [16]. Finally, authors such as [17]; [18] have identified advanced attacks in critical networks using anomaly-based approaches and multi-agent systems, highlighting the necessity for robust response techniques.

The objectives of this systematic review are: to analyze the current state of the literature on the incidence of anomalies in cybersecurity within critical sectors; to identify the most effective machine learning techniques used to enhance digital security; to explore the ethical and legal implications of ethical hacking and the most appropriate regulatory frameworks for each sector; and finally, to identify the main gaps in current research on ethical hacking and penetration testing, evaluating how the integration of emerging technologies, such as artificial intelligence, could address these gaps.

1.1 Research Questions

Research questions were established to analyze the literature on ethical hacking and penetration testing, 66 focusing on cybersecurity and risk mitigation in critical sectors. These questions guide the SLR and assess their impact on digital security.

Q1.) ¿What is the current state of the literature on the incidence of anomalies in cybersecurity and critical

69 sectors?

Q2.) ¿What are the most effective machine learning techniques used in cybersecurity in critical sectors, and what is their impact on improving digital security?

Q3.) ¿What are the ethical and legal implications of ethical hacking, and which regulatory frameworks are most suitable for each sector?

Q4.) ¿What are the main gaps in current research on ethical hacking and penetration testing, and how could the integration of emerging technologies, such as artificial intelligence, address these gaps?

2. Materials and methods

The present systematic review has been conducted following the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) methodological framework, aiming to ensure transparency and rigor in the selection and analysis of the literature. To achieve this, an exhaustive search was carried out in scientific databases such as IEEE Xplore and Scopus, selecting studies that addressed the topic of ethical hacking and penetration testing applied in cybersecurity using machine learning techniques.

The following selection criteria were established: From a total of 528 identified articles, 181 articles published between the years 2000 and 2024 were selected. These articles were chosen based on predefined inclusion and exclusion criteria, considering aspects such as the type of study, the target population, and the intervention. These criteria allowed for the delimitation of studies that provided an analysis of the current state regarding vulnerabilities, risks, and mitigation techniques in critical sectors, with a particular focus on cybersecurity. As areas of interest, the selected articles focused on evaluating vulnerabilities and risks in key sectors.

For example, in the healthcare sector, where technologies like the Internet of Things (IoT) face significant threats, risks associated with advanced persistent threats (APT) were analyzed, which compromise patient privacy [19]. In the industrial sector, the importance of protecting control systems to maintain operational continuity in critical infrastructures was highlighted [20]. In both sectors, techniques such as penetration testing and security audits were identified as essential for the detection of vulnerabilities and protection against threats [21]. Through the systematic literature review, ethical hacking is defined as the authorized practice of evaluating system security by simulating attacks to identify potential vulnerabilities. Similarly, penetration testing is established as procedures to simulate threats and analyze the response capacity of systems, while cybersecurity refers to the protection against digital attacks on critical infrastructures.

This approach allowed for the classification and analysis of machine learning techniques employed in risk mitigation specifically for each sector, underscoring the importance of standardized frameworks and robust cybersecurity practices to protect critical systems. In Phase 1, the PICO method [22], described in Table 1, was adopted, which facilitated the formulation of a specific bibliographic search strategy using the IEEE Xplore and SCOPUS databases. Additionally, the eligibility criteria for selecting relevant studies were detailed. Through Phase 2, two subsections were developed in which the research questions were formulated and the search techniques used in the repositories were defined, to ensure that the studies found were aligned with the research objective. Finally, in Phase 3, a synthesis of the collected data was performed, classifying the reviewed studies into different categories and carrying out the corresponding meta-analysis.

Phase 1: Establishment of the PICO Method and Eligibility Criteria

The PICO method [22] was utilized as a key strategy for bibliographic research, facilitating the identification of eligibility criteria for various works, studies, research, and articles. Techniques for structuring search strings were established, as shown in Table 2. To construct these strings, well-known and appropriate Boolean operators, such as ”AND” and ”OR,” were used, organizing the keywords according to the following search equation:

Tabla 2. Search Equation

For the collection of scientific articles, the search criteria detailed in Table 3 were used. The following are the different filters applied to each criterion for information gathering:

a) Criterion 1: A total of 4697 primary analyses were compiled, using the first four inclusion and exclusion criteria as shown in Table 3. The search range covered the period from 2000 to 2024, with English as the primary language of publication, and included studies such as conferences, articles, books, book chapters, magazines, and early access articles.

b) Criterion 2: Only scientific articles were considered, resulting in a total of 528 studies. A total of 448

articles were filtered from the IEEE Xplore database and 80 articles from the SCOPUS database, and the metadata for each was subsequently downloaded.

c) Criterion 3: In the third filter, a systematic literature review (SLR) was conducted on each metadata using ASReview software, identifying 161 relevant articles from the IEEE Xplore metadata and 20 relevant articles from the SCOPUS metadata.

Tabla 3. Article Typology and Criteria Used

Table 4 presents the terms used in the analysis along with their equivalents, which were employed to expand the search results and ensure broader coverage of the relevant literature.

Tabla 4. Terms Used in the Search

To select the primary studies, inclusion criteria were applied based on temporal and geographic characteristics for the study population; exclusion criteria involved discarding studies outside the established time range, gray literature, and studies in languages other than English, as shown in Table 5.

Tabla 5. Inclusion and Exclusion Criteria

Phase 3: Data Synthesis and Classification of Reviewed Studies

Data Synthesis and Classification of Reviewed Studies Information was extracted from the articles selected in Phase 1, then each study conducted in the literature on cybersecurity anomalies, affected sectors, and finally, implemented machine learning techniques were structured and synthesized.

3. Results and discussion

3.1 Q1. What is the current state of the literature on the incidence of cybersecurity nomalies in critical sectors?

In the reviewed literature, various cybersecurity anomalies have been identified, arising from deliberate attempts at unauthorized system access aimed at disrupting functionality or extracting sensitive information through the introduction of malicious software. Such actions can seriously compromise the security of the systems involved. The main detected anomalies, represented as (AN #), where corresponds to the specific anomaly number, are detailed in Table 6.

Regarding the anomalies detected in the literature, represented in Figure 1, the following trend emerges: Anomaly AN05 stands out as the most recurrent, with a total of 112 references, representing 62.22% of the total references found in the literature, closely followed by AN08 with 107 references (59.44%). These two anomalies cover a significant portion of the vulnerability spectrum, indicating that they are critical areas requiring prioritized risk mitigation in cybersecurity. Similarly, anomalies such as AN10, AN04, AN03, and AN13 also show notable frequencies, with 64 (35.56%), 61 (33.89%), 57 (31.67%), and 43 (23.89%) references, respectively, suggesting that these also represent significant risks that should not be ignored. In contrast, anomalies like AN07 have a much lower presence, representing less than 3% of the total, suggesting a relatively limited impact compared to the primary identified threats. Finally, anomalies such as AN11, AN02, AN09, AN12, AN06, and AN01 have a moderate impact, with reference percentages ranging between 3.33% and 14.44%.

The study identified critical sectors in cybersecurity with high vulnerability and a need for prioritized attention, as shown in Table 7. These sectors present a high incidence of cyber threats, highlighting the urgency of implementing advanced protection measures. This identification has enabled a deeper understanding of specific risks and facilitated the development of more effective strategies to mitigate these risks and protect critical assets. This approach underscores the importance of cybersecurity in strategic areas and provides a foundation for future research aimed at enhancing security in these environments. By focusing on the most vulnerable sectors, resource allocation and the design of more targeted security policies are optimized, which is essential for strengthening defenses against cyber threats in key sectors of the economy and infrastructure. The findings, illustrated in Table 7 and Figure 2, are fundamental for guiding the implementation of cyber defenses.

The analysis of vulnerable sectors in cybersecurity, represented in Figure 2, reveals that the Information and Communication Technology (ICT) sector is the most affected, with 13 anomalies (17.57%), followed by Telecommunications at 14.86% and Education at 12.16%. The Government and Automotive sectors each show an incidence of 10.81%. In contrast, sectors such as Energy (9.46%), Finance (8.11%), Health (6.76%), Retail (5.41%), and Manufacturing (4.05%) display a lower incidence of anomalies. These findings emphasize the importance of prioritizing cybersecurity in the most vulnerable sectors, while those less affected should strengthen their measures. Additionally, the analysis helps optimize resource allocation and design more precise security policies.

3.2 Q2. What are the most effective Machine Learning techniques used in cybersecurity within critical sectors, and what is their impact on enhancing digital security?

The systematic literature review (SLR) revealed various Machine Learning techniques applied to cybersecurity analysis, valued for their effectiveness in uncovering previously unknown relationships and patterns, which has enabled a deeper understanding of the investigated phenomena. These techniques have been fundamental in achieving the objectives outlined in the reviewed studies, contributing considerable value to the field. Additionally, they not only facilitated the discovery of new information but also opened up new research opportunities by revealing previously unexplored connections and correlations.

This focus on the use of Machine Learning techniques underscores the importance of innovation in the field of cybersecurity and ethical hacking, where the ability to detect, analyze, and mitigate cyber threats from large volumes of data has become a fundamental pillar. In these areas, Machine Learning not only enables the identification of suspicious patterns and network behavior anomalies but also facilitates the prediction and prevention of attacks, thereby enhancing the protection of critical systems and information confidentiality.

These tools allow researchers not only to confirm existing hypotheses but also to formulate new questions and explore uncharted areas, thus expanding the horizon of knowledge across various fields. The analysis techniques found in this research are presented in Table 8. On the other hand, the analysis of the techniques applied in the literature, represented in Figure 3, reveals a clear trend in the frequency of use of these techniques in recent research. Technique T01 stands out as the most utilized, with a total of 60 references, representing 33.33% of the total references, closely followed by T18, with 54 references (30.0%). These two techniques occupy a significant portion of the spectrum of applied methods, suggesting they are predominant approaches in current research and may be aligned with the most innovative and effective areas in anomaly analysis in cybersecurity. Other relevant techniques include T23 with 38 references (21.11%), T26 with 35 references (19.44%), and T04 with 34 references (18.89%), underscoring their importance and widespread use in literature. Techniques like T21 and T05 also show notable frequencies, with 28 references (15.56%) and 24 references (13.33%), respectively. This indicates that these techniques play an important role and may be associated with key areas of research. Conversely, techniques such as T08, T10, T16, T15, T12, and T22 show a lower frequency of use, with the first at 2.22% and the others at 1.67% each. This suggests that, while these techniques are present in the literature, their application is less common, possibly due to their focus on specific niches or lower effectiveness compared to the more widely used techniques.

Lastly, the different techniques found in the literature for risk detection and mitigation were analyzed for each identified anomaly. As shown in Figura 4, a cross-table of anomalies applied techniques, and references found in the SLR was created, which is presented in Table 9. The findings indicate that anomalies such as Phishing, Malware, and DoS, according to the literature, are mitigated through the application of 100% of the techniques identified in Table 8, suggesting these anomalies are extensively studied. Anomalies such as Social Engineering, Unauthorized Access, and DDoS are mitigated using more than 85% of the techniques identified in Table 9, which suggests that while they have been widely studied, there are still opportunities to incorporate additional techniques and deepen mitigation strategies. Anomalies like Advanced Persistent Threats, Spam Detection, and Network Attacks are mitigated using between 70.00% and 81.48% of the techniques identified, indicating a moderate level of study and suggesting potential for future research to expand the repertoire of applied techniques. Conversely, anomalies such as Attack Signature, Privilege Escalation, Software Vulnerability, and Password Attack are mitigated with less than 60% and 3.7%, respectively, of the techniques identified in Table 9. This highlights a low level of study and emphasizes the need for further research efforts in these areas, exploring and applying a broader range of machine learning techniques for effective detection and mitigation.

3.3 Q3. What are the ethical and legal implications of ethical hacking, and which regulatory frameworks are most suitable for each sector?

The ethical and legal implications of ethical hacking vary considerably across sectors, with a general focus on protecting privacy, data integrity, and regulatory compliance. Financial Sector: Regulations such as GDPR, ISO/IEC 27001, and PSD2 are essential to ensure systems respect user rights [23]; [6]; [9]; [13]; [15]; [18]; [24]; [25]; [26]; [27]; [28]; [29]; [30]; [31]; [32]; [33]; [34]; [35]; [36]; [37]. In cases of authorized push payment (APP) fraud, AI systems must be transparent and auditable [38]; [30]; [39]. In phishing, GDPR compliance mandates safeguarding privacy [40]; [31]; [41]; [42]; [43]; [44]. Healthcare Sector: Automated systems for phishing detection must comply with cybersecurity and data protection regulations [5]; [7]; [45]; [46]; [19]; [47] [48] [49]; [50]; [51]. Regulations like HIPAA and GDPR are fundamental for safeguarding sensitive patient data [52]; [33]; [53]; [30]; [54];[55]; [56]; [57]; [58]; [59]. These frameworks also ensure equitable access to blockchain-based healthcare systems, guaranteeing that all patients have equal rights to information protection [60]; [35]; [61]; [62]. Manufacturing Sector: In the manufacturing sector, robotic and autonomous systems raise ethical concerns regarding worker safety and industrial data protection. Standards like NERC CIP and ISO/IEC 27001 are essential to protect these systems against cyberattacks and ensure operational safety [63]; [64]; [65]; [66]; [67]; [68]; [69]; [70]; [71]; Cybersecurity professionals must manage vulnerabilities and comply with regulations such as ISO/IEC 27001 and IEC 62443 to prevent incidents and avoid legal penalties [72]. Educational Sector: In the educational sector, teaching about attacks on cyber-physical systems presents ethical and legal challenges. Institutions must educate without promoting malicious activities and comply with regulations like GDPR and the Data Protection Act to safeguard student privacy [73]; [74]; Pawlicka et al. (2023); [75]; [76]; [48]; [29]; [62]; [77]; [39]; [78]; [79]; [80]. Phishing exercises must be ethical and controlled [81]. Universities should assess vulnerabilities using tools like Burp Suite and OWASP ZAP. Information Technology Sector: In the Information Technology sector, phishing detection must comply with GDPR and NIST [82]. Blockchain and AI in cybersecurity raise ethical and legal challenges, requiring transparency according to GDPR and NIST standards [83]; [84];[62]; [85]. Vulnerability testing should follow CVSS V3.1 [86]; [87].

Risk management and ethical hackers must comply with NIST, ISO standards [88]. Information and Communication Technology (ICT) Sector: IoT developers must ensure security and privacy by complying with relevant regulations [89]. NICS should be implemented responsibly and rigorously tested [90]. In cases of cybercrime and audio forensics, experts must handle evidence with precision and adhere to ethical and legal protocols to protect privacy and ensure admissibility in court [91]. Government Sector: In critical government infrastructure, ethical hacking must be conducted responsibly to ensure security and privacy. Promoting cybersecurity education and complying with standards like NIST and GDPR while adapting policies locally is essential [92]. In critical sectors such as energy, manufacturing, and telecommunications, security must not compromise essential operations [10]; [83]; [93]; [30]; [43]; [50]; [77]. Employee education and compliance with regulations such as the Personal Data Protection Act and ISO/IEC 27001 are necessary to safeguard sensitive information [94].

Telecommunications Sector: IoT technologies face ethical and legal challenges in data protection; compliance with GDPR and ISO/IEC 27001 is essential [1]; [95]; [96]; [97]; [32]; [98], utilizing intrusion detection and encryption, and also aligning with IEEE 802.11 [99]; [100]; [101] to safeguard infrastructure and data [31]; [102]. CVSS manages critical vulnerabilities [103]. ESASCF optimizes vulnerability assessments, complying with PCI-DSS, HIPAA, and ISO/IEC 27001 [104]. The NIST Cybersecurity Framework protects networks and adheres to GDPR [105]; [106]; phishing and cloaking detection must comply with GDPR and NIST [107]. Meeting specifications and ensuring interoperability prevent penalties [108]; detecting DoS attacks in Wi-Fi maintains service availability [109]. PYMEs Sector: They must ethically protect their data against cyberattacks, optimizing resources with tools like CENSOR [64].Legally, they must comply with the NIST Cybersecurity Framework, GDPR, and the NIS Directive [110]; [62]; [43]; [50]; [77]; [54]; [67], and follow NCSC guidelines to avoid penalties. In finance, compliance with GDPR and PSD2 is essential for fraud detection [111]. Low-cost automated audits improve cybersecurity and ISO/IEC 27001 compliance. The CYRVM platform promotes accessible ethical cyber risk management for SMEs [112]. In Bahrain, cybersecurity audits help prevent cybercrime and educate employees [113].

Automotive Sector: Vehicle manufacturers have an ethical responsibility to ensure the security of their systems and sensors against cyberattacks and to comply with cybersecurity standards such as ISO/IEC 27001. They must also secure Over-The-Air (OTA) software updates to maintain system safety against new threats [114]; [39]. These standards help protect users from failures or vulnerabilities in vehicles, ensuring continuous safety [16]; [115]; [42]; [62]; [32]; [34]; [58]. Energy Sector: In critical infrastructure, it is essential to use tools such as MITRE ATT&CK exclusively for protection [116]. Legal frameworks like NIST and the NIS Directive in Europe are crucial for defending against cyberattacks [117]; [83]; [118]; [40]; [61]; [32]; [119]; [65]; [66]; [57]; [69]. Responsible management of cyber threat intelligence (CTI) must comply with data protection and cybersecurity standards [120]; [121]; [122]; [123]. Energy infrastructures should adhere to frameworks like NERC CIP and ISO/IEC 27001 to protect operational data [63]; [31]; [43]; [82].

Transportation Sector: It is essential to manage cyber incidents in transportation and aviation promptly to protect operational and passenger safety [124]. Compliance with regulations from organizations like the International Maritime Organization (IMO), GDPR, and HIPAA helps prevent vulnerabilities and protects sensitive data in critical systems [125]; [126]; [52]; [127]; [54]; [35]; [58]; [124]. The use of networks like Tor raises ethical dilemmas; while it protects privacy, it can also be exploited for illicit activities, requiring regulatory frameworks that balance protection and abuse prevention [128].

3.4 Q4. What are the main gaps in current research on ethical hacking and trust-based testing, and how might the integration of emerging technologies, such as artificial intelligence, address these gaps?

The main gaps in current research on ethical hacking and trust-based testing include:

Lack of Standardization in Ethical Hacking and Trust-Based Testing: Ethical hacking tests require a standardized method to ensure they are conducted consistently and reliably, especially in critical sectors such as healthcare and telecommunications [1]; [2]; [23]; [6]; [38]; [17]; [129]; [24]; [130]; [74]; [131]; [125]; [31]; [55];

[33]. In phishing detection, convolutional neural network (CNN)-based methods still face inconsistencies due to the lack of a global standard [11]; [27]; [10]; [132]. Limitations in the Transferability of Machine Learning Models: Machine learning models are often highly specific to the data on which they were trained, making it challenging for them to perform well in new contexts [3]; [130]; [131], This is especially true in fields where data changes rapidly, such as healthcare and energy, [6].

Data Privacy and Trust Management in Collaborative Networks: Collaborative systems for intrusion detection face challenges in protecting privacy and establishing trust among their components [7]; [133]; [38]; [74]; [31]. Furthermore, limited interoperability between cybersecurity platforms remains a challenge in trust management [97]; [134]; [19]; [135]. Blockchain technology presents a potential solution to these challenges [13]; [18]; [121]; [63]; [136].

Lack of Integration of Ethical Hacking and Trust-Based Testing in Cyber-Physical Systems (CPS): These systems lack robust strategies to protect against advanced attacks [110]; [84]; [42]. Existing solutions face scalability issues due to high computational costs. The lack of integration of ethical hacking and trust-based testing hinders the proper evaluation of system resilience in real-world environments [76]; An and [31]; [82]. Limited Automation in Cyberattack Response: Many current systems lack automation in their responses to cyberattacks, which is crucial for mitigating the damage caused by advanced threats; [49]; [32]; [137]; [119]; [127]; [98]; [77]; [51]; [65]; [53]; [138]; [66]; Although some studies focus on detection mechanisms, the lack of integrated automated responses remains a significant gap. [34]; [85];

This lack of automation can lead to delayed responses, increasing the impact and potential damage of attacks. Limited Integration of AI in Emerging Threat Detection: AI has shown potential to enhance privacy and trust in distributed networks; however, its integration in emerging threat detection remains limited [121]; [40]; [52]; [44]. This is particularly relevant in collaborative environments, where the lack of AI-driven automation restricts systems’ ability to dynamically adjust security levels [62]; [139]. Knowledge Transfer and Adaptability of AI: In phishing detection, feature selection and ensemble approaches, such as stacking, maintain high levels of accuracy, optimizing transfer between different datasets [5]; [6]; [9]; [15]. Lack of a Predictive Focus in Current Research on Ethical Hacking and Trust: Currently, cybersecurity research emphasizes reactive responses to cyber incidents rather than proactive anticipation.

Ethical hacking is typically employed after an attack has occurred [36], with limited exploration of artificial intelligence (AI) to predict and prevent cyberattacks. AI could detect anomalous behaviors and vulnerabilities in critical networks before they are exploited [37]; [140]; [70]. Dependence on Human Intervention: Various studies indicate that threat detection and response rely heavily on human intervention, limiting defense capabilities against attacks like phishing [78]. AI can automate this process, enabling faster reactions [141]. Absence of Dynamic and Personalized Models in Cybersecurity: Cybersecurity solutions need to be personalized according to user profiles [39]. As current approaches do not adapt to emerging real-time threats.

Dynamic and personalized AI-based models can optimize security by adjusting to user behavior and specific threats, reducing false positives and increasing defense efficiency [142]; [100]. Lack of Integration in Credential Management and Trust-Based Testing: There is a lack of personalized approaches in credential management and trust-based testing following security breaches; current systems do not adjust responses based on the risk level of compromised credentials [116]; [89]. Integrating AI could automate credential revocation and enable dynamic risk-based responses. Limitations in Scalability and Cost: While AI-based solutions are effective, large-scale adoption is limited by high costs [94]; [143]; [4], leaving organizations vulnerable.

There is a lack of AI in hybrid scenarios that address both physical and digital threats, representing a gap in the protection of critical infrastructure. Lack of AI Integration in Trust-Based Testing: NICS and HARMer face adoption and maturity challenges due to a lack of standardization and the complexity of intensive testing and configurations required in large networks [109]; [101]; [144]; [145]. AI could optimize these systems by automating customization and improving predictive capabilities [86]; [72]; [81]. The lack of predictive approaches leaves many organizations exposed to advanced cyberattacks [146]; [147]. Limitations in the Scalability of Security Solutions for Enterprise Networks: There are significant challenges in scaling cybersecurity solutions for large, complex enterprise networks [148]; [149]. AI-based approaches could improve efficiency by managing large data sets in real time and optimizing anomaly detection [79]; [80].

4. Conclusions

The integration of artificial intelligence in ethical hacking and trust-based testing is essential for enhancing cybersecurity and risk mitigation. AI facilitates knowledge transfer and model adaptability, allowing rapid adjustment to new contexts without requiring complete retraining. This is particularly relevant in critical areas such as phishing, where techniques like feature selection and ensemble methods, such as stacking, maintain high levels of accuracy when transferring knowledge across different datasets. The combination of blockchain and AI strengthens privacy and trust in threat detection, ensuring data authenticity and process transparency. In environments like IoT networks, this integration improves interoperability and enables more effective trust management. Furthermore, AI automates responses to cyberattacks, proactively blocking threats in real time and providing dynamic defense strategies that adjust to the evolving nature of risks. This allows organizations to dynamically adjust their security mechanisms, balancing data privacy and utility. Finally, AI enables continuous simulations of ethical hacking, allowing for ongoing assessment of cybersecurity robustness throughout an attack’s lifecycle. This approach helps uncover vulnerabilities that might go unnoticed with traditional methods, significantly improving overall system security. Automation in attack planning and defense adaptation through advanced algorithms allows for the identification of complex attack patterns and dynamic adjustments in security responses. Therefore, the implementation of AI in penetration testing is crucial to enhancing the resilience of cyber systems, effectively anticipating and mitigating increasingly sophisticated threats.

5. Acknowledgments

The authors would like to thank the Servicio Nacional de Aprendizaje (SENA), Centro de Servicios y Gestión Empresarial – Antioquia Regional Office, for its institutional support and assistance in developing this research. Academic guidance and a commitment to applied research were fundamental to the consolidation of the results presented in this article.

6. Authors' contributions