---
id: "action-use-llm-to-attack"
type: "action-item"
source_timestamps: ["¶12"]
tags: ["red-teaming", "ai-defense"]
related: ["concept-ai-assisted-penetration-testing", "question-llm-attack-methodology", "framework-dobrygowski-smb-cyber-defense"]
action: "Employ an LLM to simulate attacks on your network to find vulnerabilities."
outcome: "Identifies hidden network vulnerabilities and generates patching solutions."
speakers: ["Daniel Dobrygowski"]
sources: ["governance"]
sourceVaultSlug: "hbr-seg-governance"
originDay: 7
articleStem: "hbr-sig-57-smb-cyber-risk"
sourceUrl: "https://hbr.org/2026/06/ai-is-changing-cyber-risk-heres-how-smbs-can-respond"
sourceTitle: "AI Is Changing Cyber Risk. Here’s How SMBs Can Respond."
---
# Use LLMs for Penetration Testing

**Action:** Hire consultants or use internal resources to deploy a Large Language Model (LLM) to actively "attack" your own network. This proactive red-teaming unearths vulnerabilities and helps devise solutions before malicious actors find them.

**Outcome:** Identifies hidden network vulnerabilities and generates patching solutions.

**Where it fits:** Step 4 ("Use AI to test your defenses") of [[framework-dobrygowski-smb-cyber-defense]]; the operational form of [[concept-ai-assisted-penetration-testing]].

> [!warning] Handle with care (enrichment)
> For SMBs, pointing a general-purpose LLM at a production network is operationally and legally risky (outages, misconfiguration, leaking sensitive data to the model provider). Safe use requires sandboxing, tight scoping, and professional oversight — prefer specialized tools or professional pen-testers. Open implementation gaps are tracked in [[question-llm-attack-methodology]].