High Level Description
Insecure systems are everywhere. What matters is who finds the exploit first. Internal networks, such as an office LAN, are often assumed to be secure, but a single rogue or insecure IoT device, such as a smart TV, can give an attacker a way in. Penetration testing means trying to break into your own systems, with permission, to find security issues before an attacker does. It needs skilled people, so it is often done only now and then, while the systems keep changing.

Large Language Model (LLM) agents can now use tools and solve tasks in several steps. They are starting to be used for attacks, but how useful they are for defence is not yet well studied.

This thesis will investigate how an LLM agent can secure a network by acting as an attacker. The agent finds issues, investigates them and sends a report to the person responsible for the security posture.

Project Description
This thesis aims to evaluate LLM penetration testing as a way to continuously secure networks and environments.

An LLM agent will run from a jump host inside a test environment with known vulnerabilities. The agent does the whole process by itself. It performs reconnaissance such as port scanning, finds vulnerabilities, tries to exploit them and sends a report. The reports are compared with the known vulnerabilities, and the actions of the agent are checked for anything unsafe.

Security is easy to deprioritise when schedules are busy. Testing continuously instead of now and then means issues can be found sooner, by the right people rather than by attackers.

Examples of relevant technologies include MCP (Model Context Protocol), Linux and Nmap. Examples of relevant vulnerabilities include weak or default credentials, poor network segmentation, misconfigurations, and web vulnerabilities from OWASP Top 10.

Who are we looking for?

• Bachelor/Master of Science in Computer Science, Computer Engineering, or related fields.

• Graduation in June 2027

• Fluency in Swedish, both written and spoken

• Fluency in English, both written and spoken 

• Interest in cybersecurity and artificial intelligence is a plus!
  

Purpose
This thesis will investigate the following areas:

1. Automated penetration testing – Investigate how well an LLM agent can do a whole penetration test by itself, from reconnaissance to exploitation and reporting. Measure how many of the known vulnerabilities it finds and exploits, and how long it takes.

2. Reliability of findings – Are the reports useful, or full of false positives? Can multi-agent orchestration be used to verify the reports?

3. Trust in LLM agents – Can agents be trusted in sensitive environments, and what if they break something? A human tester knows not to cause a denial of service, but an agent might not. Investigate if cloned environments or sandboxing the agent reduce this risk.

Limitations

The implementations are proof-of-concept, not finished products, and are meant for experimentation and evaluation. The long-term goal is that the results can later be developed into a useful solution for businesses.

• The agent accesses the environment from a single jump host, not from several points. It runs through a managed agent CLI, such as Claude Code or GitHub Copilot CLI, or in a setup we host ourselves.
  

• The agent only needs to find known vulnerabilities and common weaknesses. Finding zero-day vulnerabilities is out of scope.

• Testing is only done on authorised targets, with a defined threat model, such as an attacker inside the local network or from the outside.

• The study uses existing models. Training our own models is out of scope, and fine-tuning is only considered if there is a clear reason for it.
  
  
  An Exciting Journey with Knightec Group
  Semcon and Knightec have joined forces as Knightec Group. Together, we are Northern Europe’s leading strategic partner in product and digital service development. With a unique combination of cross-functional expertise and a holistic business understanding, we help our clients realize their strategies – from idea to complete solution.

Practical Information
This is a thesis position, located at our office in Sundsvall. Start date January or March 2027.

Please submit your application as soon as possible, but no later than 2026-11-30. If you have any questions, you are welcome to contact johanna.edstrom@knightec.se. Note that due to GDPR, we only accept applications through our careers page.