Permission to attack. How Block8.ai governs an AI built to break in

Most conversations about responsible AI are about keeping a system from doing harm by accident. Block8.ai has a harder version of the problem. Its AI is built to do harm on purpose, to a system its owner has asked it to attack, so that the owner finds the weakness before a criminal does.

Penetration testing is the practice of breaking into your own systems to see how an attacker would. Done by hand it is slow, expensive and hard to repeat, which is why most small and mid-sized Australian organisations have never had one. Block8.ai, a Perth company founded in 2025, set out to make a credible test as easy to buy as online banking. AI agents do the scanning, analysis and exploitation. CREST-certified human testers check every finding before a client sees it.

That raises a question any buyer should ask, and any regulator will. If the AI's job is to break in, what stops it going somewhere it should not, doing more than it was asked, or reporting something that is not true? The answer Block8 gives is not a promise. It is a set of controls, written down, that an outsider can read.

In October 2026 Block8.ai became the first penetration testing business certified by Responsible AI Australia, at the Govern tier. This is the story of what that assessment looked at.

What Block8.ai does

A client logs into Block8's portal, chooses what to test, a web application or an external or internal network, and sets the scope. The platform generates rules of engagement from that scope. The client accepts them. Testing runs when the client says, at once or on a schedule that suits their operations team, and the portal reports progress through planning, scheduled, active, completed and report published.

Behind the portal, the methodology runs in five phases drawn from OWASP and NIST. Scanning identifies candidates. Block8's own AI toolset analyses them and separates real findings from false positives. AI agents then attempt exploitation, which is the part of a test that normally eats the most expert hours. A senior tester reviews the assessment, the exploitation and the final report before each stage moves on, a process Block8 calls Three-Level Validation. Clients receive an executive report, a technical report with human validation noted against each finding, and a one-page certificate. Anything found can be retested within 60 days.

The platform is Block8's own build, not a third-party engine resold under another name. It runs on AWS in Sydney, with model inference through Amazon Bedrock in the same region, and the company contracts under Western Australian law. Those are the kinds of facts Block8 chooses to publish, and that habit is the thread running through everything below.

Why the AI needs a boundary, not a conscience

A general-purpose assistant is governed by trying to shape how it behaves. A penetration testing agent is governed differently, because the behaviour you want from it is exactly the behaviour you would never want elsewhere. What matters is where it is allowed to behave that way, how far it may go, and who can stop it. Block8 published its answer to those three questions in October 2026. The scope comes from the client.

From that principle follow six controls, each of which was visible to our assessors in Block8's own documentation and is now visible to anyone on its website.

Two details in that list say more about Block8's culture than any badge. The first is the admission. Out-of-scope rules that the AI follows during a test are described by the company itself as a best-effort control, not a hard block, and its advice to clients is to leave a fragile system off the target list altogether rather than rely on an exclusion. The second is the second stop button. A client kill switch is good practice. A faster one in the hands of the vendor, for when the client is not watching, is what it looks like when a team has thought about the failure case.

The human is not a disclaimer

Plenty of AI products describe a human in the loop. Block8 is specific about what the human is for. In its own account, AI is strong at pattern matching across known vulnerability classes and weak at context. It cannot reliably tell whether a flagged issue is reachable by an attacker, whether it matters given the rest of the environment, or how several low-severity findings combine into one serious route in.

So a human tester closes the gap by attempting to exploit the finding, confirming it behaves the way the pattern match suggested, and chaining disconnected findings into a single attack path where the AI saw only fragments. False positives are not quietly dropped. They stay on the record with the reason they were rejected. Block8 offers an AI-only tier for routine internal triage and recommends the human-validated tier for anything that will be shown to an auditor, a board or a customer. The distinction is drawn in the product, not just in the marketing.

How Block8 governs its AI

The guard rails govern what the agent does on a client's systems. Block8's internal governance covers everything around it, and it is built on a foundation the company already had. Its Trust Centre publishes an ISO/IEC 27001:2022 certificate, issued by Southpac Certifications in May 2026 with a scope that covers its AI-driven penetration testing and security reporting services, and lists Block8 as a CREST ANZ approved member company. Four commitments from its Responsible AI profile stand out.

Data handling follows the same pattern of saying exactly what happens. Client environment data, the system responses, captured traffic, observed credentials and configuration that a test touches, is processed in memory for the duration of the engagement and not retained afterwards. Findings data is kept for twelve months to support retesting, with earlier deletion on written request. Every subprocessor is named, with a promise of at least 30 days' notice before a material change. A SOC 2 Type II audit is scheduled for the first quarter of 2027.

Why certification, and why now

Block8 already held the two credentials a penetration testing buyer usually asks for. Neither of them says anything about how the company governs AI. ISO 27001 covers information security management. CREST covers testing methodology, data handling and the vetting of people. The AI agent doing the exploitation sits in a gap between the two, and it is the part of the service a procurement team is now most likely to ask about.

The Govern tier is the highest of the three Responsible AI Australia tiers. To reach it, Block8.ai signed the Responsible AI Pledge and showed a governance framework covering risk management, oversight roles, impact assessments and accountability, with its chief executive named as the person responsible for AI oversight. The assessment asked for evidence, not intent. The scope controls, the model isolation, the policy on what staff may type into third-party tools and the human validation at every stage were all there to be checked against Australia's AI Ethics Principles.

Block8 now displays the certification on its home page, lists it in its Trust Centre alongside ISO 27001 and CREST, and links both to the public register entry where anyone, including an AI procurement agent, can verify it in milliseconds.

The timing matters. From 10 December 2026, the Privacy Act requires the businesses it covers to disclose automated decision-making in their privacy policies. The Australian Government has also announced Australian Standards for AI, which it expects to legislate in 2027. Security teams that buy AI-driven testing will increasingly be asked by their own boards how that AI is controlled. Block8's clients can point to a published answer.

What it means for the sector

Offensive security is one of the first fields where AI agents are acting on live systems at scale, with real permission to cause real effects. The habits that field forms now will travel. Block8 has set a useful example. Define the boundary before the first command. Make the client the author of the scope. Stop at proof. Keep two hands on the off switch. Log everything, including the findings you rejected. Then publish all of it so your customers do not have to take your word for it.

An AI built to break in turns out to be a good test of what responsible AI means in practice. Not an AI that never does anything dangerous, but one that does exactly what it was authorised to do, no more, with a human who can prove it.

Responsible AI Australia certifies Australian businesses across three tiers, Commit, Embed and Govern, recognising progressive levels of commitment to ethical and responsible AI practice. To learn more about certification, get in touch.