Step 1 – Describe the Application

Start with the basic features of your test application:

Application: Internal web application
Authentication: Username/password
API: REST
File upload: Yes
Admin panel: Yes
User roles: User and Administrator

You don’t need a complicated prompt yet.

Step 2 – Ask AI to generate Test cases

Try:

I'm performing an authorized security assessment of this application.

Create a practical security testing plan covering:

- Authentication
- Authorization
- Session management
- Input validation
- File uploads
- REST API security
- Access control
- Common web vulnerabilities

For each test:
- Explain what I'm testing
- Give a safe example
- Explain what evidence would indicate a problem

Do not provide destructive payloads.

AI can turn the application description into a structured testing plan.

Step 3 – Add your Technology Stack

The results become more useful when you provide additional context.

For example:

Technology stack:

Frontend: React
Backend: Python
API: REST
Database: PostgreSQL
Authentication: JWT
Reverse proxy: Nginx

Update the security test plan based on this stack.
Highlight tests that are particularly relevant to these technologies.

Now you’re getting a plan tailored to the application rather than a generic checklist.

Step 4 – Turn Tests into a Checklist

Finally, ask AI to create something you can actually use during the assessment:

Convert the security test plan into a checklist.

Use this format:

[ ] Test
    Expected behavior:
    Evidence to collect:
    Result:
    Notes:

You can then work through the assessment one test at a time.

The Workflow

Application Information
        ↓
       AI
        ↓
Security Test Plan
        ↓
Manual Testing
        ↓
Evidence
        ↓
Findings

The important part is that AI is helping you plan the assessment, not making the security decision for you. This can be especially useful when testing unfamiliar applications or when you want to make sure important areas aren’t forgotten.