Penetration Testers
Computer and Mathematical Occupations- O*NET-SOC code
- 15-1299.04
Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.
- Data source: BLSPublished: 2026-08
Very high· relative
LowFour relative bandsVery highGroup-level value
Scale, basis and source
Four relative bands (Low / Moderate / High / Very high)
831 detailed occupations in the BLS Employment Projections table. Assigned per National Employment Matrix (NEM) code, so occupations sharing a NEM code carry the same band
- Data source: AnthropicPublished: 2026-03
0.311
0.000Range of values carried here0.745Group-level value
Scale, basis and source
Observed exposure index, 0–1 as published
Mapped onto O*NET tasks
Published per SOC 2018 occupation; every O*NET occupation with the same SOC 2018 code carries this value
- Data source: ILOPublished: 2025
0.43–0.55· 3 ISCO-08 groups
Scale, basis and source
Generative AI exposure index, 0–1 as published
Published per ISCO-08 unit group. Linked to this occupation, wholly or in part, by applying U.S. Bureau of Labor Statistics crosswalks (ISCO-08 to 2010 SOC, 2010 SOC to 2018 SOC) as published
What kind of figure this source publishes
The BLS category is a relative rank, not an absolute level, and it is not a first-hand measurement: it groups an occupation's percentile ranks across several published studies into four bands. It is not an employment or wage forecast, not a probability of adoption, and it does not separate automation from augmentation.
ILO value for each linked ISCO-08 group
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified0.55
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified0.49
- ISCO-08 3511Information and Communications Technology Operations Technicians0.43
Task-level exposure
Show 1 hidden task22 rated tasks · 21 tasks with β ≥ 0.5 (95.5%)
β = direct exposure (E1) + 0.5 × exposure when tools are available (E2), per the source repository's definition.
- Source unit: O*NET 27.2 tasks → O*NET 31.0 occupation code
- All rated tasks are in the O*NET 31.0 task list.
- Source
- OpenAI "GPTs are GPTs" exposure rubric
- Release
- gh-main-0471612
- License
- MIT License, Copyright (c) 2024 OpenAI
Values in this tab are predicted labels, not observations. Eloundou et al. (2023) published two rating regimes — human raters and GPT-4 — and the β shown here is derived from the GPT-4 rater basis alone; the same task can take a different value under the other regime. The unit and the meaning differ from the observed shares (%) in the other tabs, so do not place them on the same axis.
| Task (O*NET 27.2) | βE1 + 0.5 × E2 |
|---|---|
Conduct network and security system audits, using established criteria.O*NET Task ID 21746 | 1.0 |
Configure information systems to incorporate principles of least functionality and least access.O*NET Task ID 21747 | 1.0 |
Design security solutions to address known device vulnerabilities.O*NET Task ID 21748 | 1.0 |
Develop and execute tests that simulate the techniques of known cyber threat actors.O*NET Task ID 21749 | 1.0 |
Develop infiltration tests that exploit device vulnerabilities.O*NET Task ID 21750 | 1.0 |
Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests.O*NET Task ID 21752 | 1.0 |
Document penetration test findings.O*NET Task ID 21754 | 1.0 |
Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries.O*NET Task ID 21755 | 1.0 |
Gather cyber intelligence to identify vulnerabilities.O*NET Task ID 21756 | 1.0 |
Identify security system weaknesses, using penetration tests.O*NET Task ID 21758 | 1.0 |
Keep up with new penetration testing tools and methods.O*NET Task ID 21760 | 1.0 |
Prepare and submit reports describing the results of security fixes.O*NET Task ID 21762 | 1.0 |
Test the security of systems by attempting to gain access to networks, Web-based applications, or computers.O*NET Task ID 21763 | 1.0 |
Write audit reports to communicate technical and procedural findings and recommend solutions.O*NET Task ID 21765 | 1.0 |
Collect stakeholder data to evaluate risk and to develop mitigation strategies.O*NET Task ID 21745 | 0.5 |
Develop presentations on threat intelligence.O*NET Task ID 21751 | 0.5 |
Discuss security solutions with information technology teams or management.O*NET Task ID 21753 | 0.5 |
Identify new threat tactics, techniques, or procedures used by cyber threat actors.O*NET Task ID 21757 | 0.5 |
Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis.O*NET Task ID 21759 | 0.5 |
Maintain up-to-date knowledge of hacking trends.O*NET Task ID 21761 | 0.5 |
Update corporate policies to improve cyber security.O*NET Task ID 21764 | 0.5 |
β = E1 + 0.5 × E2 · E1 = tasks where direct LLM access alone cuts time by at least 50%, E2 = tasks where software built on top of an LLM cuts time by at least 50%. Values take only 0 / 0.5 / 1.0.
Data sources & licenses — O*NET®, Eloundou et al. (2023): see full notices on the Credits page
All O*NET 31.0 task statements (22)
All O*NET 31.0 task statements for this occupation (English, as published; task type core or supplemental). Exposure values are not listed here; they are in the table above, next to each task statement as worded in the O*NET version each source used.
| Task (O*NET 31.0) | Type |
|---|---|
| Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters. | Core |
| Collect stakeholder data to evaluate risk and to develop mitigation strategies. | Core |
| Conduct network and security system audits, using established criteria. | Core |
| Configure information systems to incorporate principles of least functionality and least access. | Core |
| Design security solutions to address known device vulnerabilities. | Core |
| Develop and execute tests that simulate the techniques of known cyber threat actors. | Core |
| Develop infiltration tests that exploit device vulnerabilities. | Core |
| Develop presentations on threat intelligence. | Core |
| Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests. | Core |
| Discuss security solutions with information technology teams or management. | Core |
| Document penetration test findings. | Core |
| Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries. | Core |
| Gather cyber intelligence to identify vulnerabilities. | Core |
| Identify new threat tactics, techniques, or procedures used by cyber threat actors. | Core |
| Identify security system weaknesses, using penetration tests. | Core |
| Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis. | Core |
| Keep up with new penetration testing tools and methods. | Core |
| Maintain up-to-date knowledge of hacking trends. | Core |
| Prepare and submit reports describing the results of security fixes. | Core |
| Test the security of systems by attempting to gain access to networks, Web-based applications, or computers. | Core |
| Update corporate policies to improve cyber security. | Core |
| Write audit reports to communicate technical and procedural findings and recommend solutions. | Core |
0.00/ 3· Robot exposure index
Scale, basis and source
Each physical task is graded 0–3 by the setting in which robots that have been deployed, sold or demonstrated could do it (0 none · 1 purpose-built robot settings such as a fenced machine cell or a bottling line · 2 structured facilities such as a hospital pharmacy or a container port · 3 unstructured settings such as a private home or a construction site), and the grades are averaged by share of working time
Physical tasks among this occupation's O*NET 29.3 tasks
Anthropic estimated the grades and time shares with Claude Opus 5 using web search, as of 2026.
The robot exposure index is a different measure from the AI exposure figures on this site and cannot be added to or compared with them. It does not measure actual adoption or cost, and 0 also covers occupations with no physical tasks.
Tier of each physical task
Robot environment tiers (E0–E3)
E0 noneDetails
Rated not doable by robots that have been deployed, sold or demonstrated, even in a purpose-built setting
E1 purpose-built robot settingsDetails
Rated doable in a setting built around the machine, such as a fenced machine cell or a bottling line
E2 structured facilitiesDetails
Rated doable in a human work facility that an institution keeps to a working standard, such as a hospital pharmacy or a container port
E3 unstructured settingsDetails
Rated doable in a setting that no institution keeps to a working standard, such as a private home or a construction site
Only tasks classified as physical are listed; other tasks have no tier in the source.
| Task (O*NET 29.3) | Robot environment tier |
|---|---|
| Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters. | E0 none |
Occupation information
Employment outlook (BLS)
Values for the whole SOC 15-1299 group (Computer occupations, all other), not for this O*NET occupation alone.
- Employment, 2025
- 471K
- Projected employment, 2035
- 495K
- Change (2025–35)
- +5.1%
- Median annual wage, 2025
- $116,580
- Typical education needed for entry
- Bachelor's degree
Korea classification links (KSCO)
Links from the current release of the Korea Occupation Direct Crosswalk v1.1, made by AI Changing Work. Relation values are read from the O*NET-SOC occupation side.
| KSCO code | KSCO title | Relation | Status |
|---|---|---|---|
| 22399 | 그 외 네트워크 및 정보 보안 전문가 | This occupation is narrower | confirmed |
Relation and status definitions(kr-direct v1.1)
ILO occupational description
AI Changing Work links the ISCO-08 unit groups below to this occupation by applying the U.S. Bureau of Labor Statistics crosswalks (2018 SOC to 2010 SOC, 2010 SOC to ISCO-08) as published, without case-by-case selection; each link may be whole or partial.
- ISCO-08 2519Software and Applications Developers and Analysts Not Elsewhere Classified
- ISCO-08 2529Database and Network Professionals Not Elsewhere Classified
- ISCO-08 3511Information and Communications Technology Operations Technicians
Sources: ILO ISCO-08 — details: Credits
ESCO occupational vocabulary
Each entry below is matched to this occupation in the published ESCO-O*NET Crosswalk (version 1, 2022). The match types are that crosswalk's; the wording is AI Changing Work's.
- ethical hackerESCO 2529.3Same scope
Ethical hackers perform security vulnerability assessments and penetration tests in accordance with industry-accepted methods and protocols. They analyse systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.
Source: European Commission, DG EMPL — ESCO API 2026-08-08 (bridge v1.2.1)
License: CC BY 4.0 (EU Reuse Notice)
ESCO reuse terms and the modification notice are in Credits.
France classification links (ROME)
AI Changing Work's links between this occupation and ROME 4.0 job profiles, judged with AI models. Relations are read from this occupation's side. Links marked “provisional” were adopted on the judgments of two judges from the same model family (Claude) alone, or by an operator rule applied to their judgments, so they rest on weaker evidence than confirmed links.
| ROME code | ROME title (French) | Relation |
|---|---|---|
| M1866 | Pentesteur / Pentesteuse | Same scopeprovisional |
| M1863 | Evaluateur / Evaluatrice sécurité des systèmes et produits informatiques | Related, not a matchprovisional |
Source: France Travail — Répertoire Opérationnel des Métiers et des Emplois (ROME 4.0), version 61, last updated 15 June 2026 (https://www.data.gouv.fr/datasets/repertoire-operationnel-des-metiers-et-des-emplois-rome). Licence Ouverte 2.0.
ROME codes and titles are reproduced unchanged; the links to O*NET-SOC occupations are AI Changing Work's own judgment and are not a France Travail correspondence.
(AI Changing Work link release: fr-direct v1)
Spain classification links (CNO-11)
AI Changing Work's links between this occupation and CNO-11 occupations, judged with AI models. Relations are read from this occupation's side.
| CNO-11 code | CNO-11 title (Spanish) | Relation |
|---|---|---|
| 2729 | Especialistas en bases de datos y en redes informáticas no clasificados bajo otros epígrafes | This occupation is narrowerprovisional |
Source: Instituto Nacional de Estadística (INE), National Classification of Occupations 2011 (CNO-11, Royal Decree 1591/2010) — www.ine.es · Licensed CC BY 4.0. CNO-11 codes and Spanish titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not an INE correspondence.
(AI Changing Work link release: es-direct v1)
Germany classification links (KldB)
AI Changing Work's links between this occupation and KldB occupations, judged with AI models. Relations are read from this occupation's side.
| KldB code | KldB title (German) | Relation |
|---|---|---|
| 43384 | Berufe in der IT-Netzwerktechnik, IT-Koordination, IT-Administration und IT-Organisation (sonstige spezifische Tätigkeitsangabe) - hoch komplexe Tätigkeiten | This occupation is narrower |
Source: © Statistik der Bundesagentur für Arbeit — Klassifikation der Berufe 2010 – überarbeitete Fassung 2020, https://statistik.arbeitsagentur.de. KldB codes and titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own mapping (eigene Zuordnung) and are not a Bundesagentur für Arbeit correspondence.
(AI Changing Work link release: de-direct v1)
Japan classification links (JSCO)
AI Changing Work's links between this occupation and JSCO occupations, judged with AI models. Relations are read from this occupation's side.
| JSCO code | JSCO title (Japanese) | Relation |
|---|---|---|
| 109 | その他の情報処理・通信技術者 | This occupation is narrower |
| 105 | システム運用管理者 | This occupation is narrowerprovisional |
Source: Ministry of Internal Affairs and Communications (MIC), Japan Standard Occupational Classification (Dec. 2009, MIC Notification No. 555). JSCO codes and Japanese titles are reproduced unchanged; the links to O*NET occupations are AI Changing Work's own judgment and are not a MIC correspondence.
(AI Changing Work link release: jp-direct v1)
Sources, licenses and AI Changing Work's modification and translation notices for this page: Credits & sources