AI may disrupt application pentesting sooner than expected

At a glance

What this is: This is a FireCompass analysis arguing that AI agents are already surpassing humans in repeatable application pentesting tasks because the workflow is highly verifiable.

Why it matters: It matters to IAM and security teams because access-control testing, authorization validation, and trust-boundary checks are among the most automatable parts of offensive security, which changes how they should evaluate application risk.

By the numbers:

• FireCompass says its application pentest agents are now beating top researchers 60 to 70% of the time while staying under 2% false positives.
• FireCompass reports that its web application pentest agents reached 100% on public test benches such as XBen before moving to researcher-versus-agent evaluation.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read FireCompass's analysis of why AI may disrupt application pentesting earlier than expected

Context

Application pentesting is a form of security testing that tries to prove whether controls fail under real attack conditions, especially around authorization, injection, and state changes. FireCompass argues that this work is becoming more automatable because many of the most valuable checks are mechanically verifiable rather than purely judgment-based, which creates a direct identity and access control intersection.

That intersection matters for IAM and NHI practitioners because pentest workflows repeatedly test authentication boundaries, privilege boundaries, and evidence of overexposed access paths. The broader lesson is that validation-heavy security work is shifting toward agent-assisted execution, while human expertise remains most valuable in objective setting, business context, and interpreting ambiguity.

Key questions

Q: How should security teams implement AI penetration testing for agents and models?

A: Start with the highest-risk workflows first, especially agents that can access SaaS data, APIs, or approval paths. Then combine adversarial input testing, tool-use abuse scenarios, and output leakage checks with CI/CD or MLOps gates. The goal is to catch both model weaknesses and the permission paths that let an attacker turn model behaviour into operational impact.

Q: Why do agentic pentest systems improve faster than traditional tools?

A: They improve quickly when each step creates immediate feedback. If an agent can test a route, observe the result, and retry with a different branch, it can compound learning across many small moves. That makes application testing unusually suitable for agentic automation because the workflow contains repeated, checkable decisions rather than one-off analysis.

Q: What do security teams get wrong about AI-generated penetration testing findings?

A: The main mistake is treating AI output as proof rather than as a lead. Findings still need manual confirmation, especially when the issue involves chained weaknesses, session logic, or privilege escalation. Good programmes use AI to surface more candidate paths, then rely on experienced testers to prove whether those paths are real and material.

Q: How should organisations divide work between AI agents and human researchers?

A: Let AI agents handle repetitive discovery, validation, and retry-heavy testing, while humans set objectives, interpret ambiguous findings, and decide what matters commercially. That division keeps the machine in the high-feedback loop and preserves human judgment for risk prioritisation, context, and supervisory control over the offensive system.

Technical breakdown

Why verifiability matters in AI-assisted pentesting

Application pentesting rewards systems that can act, observe, and refine quickly. When an agent can test whether an endpoint exists, whether authorization was bypassed, or whether a payload caused a state change, it receives concrete feedback and can improve the next step. That is different from many security tasks where success is subjective or delayed. The result is compounding performance in workflows built from small, testable moves rather than one giant reasoning leap.

Practical implication: teams should evaluate AI offensive tooling on evidence quality and feedback-loop design, not on generic model capability.

Benchmark saturation and the limits of public test benches

Public benchmarks are useful until a system learns the test pattern itself. After that, high scores can hide poor performance in messy, stateful, or open-ended environments. FireCompass describes the pivot from public benches to researcher-versus-agent evaluation for exactly this reason. In security testing, the real challenge is not passing a scripted scenario but sustaining accurate exploration across branching paths without flooding teams with noise.

Practical implication: replace benchmark-only assessments with live, scenario-based validation against realistic applications and controls.

Why agentic systems outperform in repetitive control validation

Agentic systems are well suited to deep, wide, persistent exploration. They can enumerate routes, retry variations, carry state forward, and keep testing without fatigue. In application security, that is valuable for access-control validation, attack-path enumeration, and evidence gathering. Human researchers still excel at deciding what matters, but machines increasingly win at the repetitive search and confirmation work that surrounds the highest-value finding.

Practical implication: reserve humans for objective selection and interpretation, and let automation absorb the repetitive validation loop.

Threat narrative

Attacker objective: The objective is to identify and validate exploitable application weaknesses faster than human-led testing alone, increasing the volume and speed of successful offensive discovery.

1. Entry occurs when an application exposes a testable route, endpoint, or trust boundary that can be probed repeatedly by an agentic system.
2. Escalation happens as the agent chains validated micro-successes, such as bypassing one control, then reusing the result to test the next boundary or state transition.
3. Impact is faster discovery of exploitable weaknesses, reduced false-positive noise, and a materially shorter path from hypothesis to confirmed security finding.

NHI Mgmt Group analysis

Verifiability is becoming the decisive force multiplier in offensive security. When a workflow gives an AI system rapid, objective feedback, the system can outpace humans in narrow but important tasks. Application pentesting fits that pattern unusually well because many steps are measurable, repeatable, and evidence-driven. That means the market will increasingly reward systems that can close the loop between action and validation, not just systems that can generate plausible hypotheses. Practitioners should treat verifiability as a design criterion for both attack and defense tooling.

AI will take the repetitive control-validation layer first, not the whole pentest function. The article describes a split between execution-heavy tasks and higher-order human judgment. That split is real and useful for security teams, because it suggests where automation can safely scale and where human review still matters. The named concept here is validation-heavy security work: the subset of offensive testing where success can be checked immediately and objectively. Teams should expect this layer to compress fastest.

Application security is becoming a governance problem as much as a testing problem. Once agentic systems can test access controls, authorization paths, and state transitions at machine speed, the question shifts to oversight, evidence quality, and decision authority. That intersects directly with IAM because authorization boundaries are being exercised continuously rather than periodically. The control gap is not whether testing happens, but whether the organisation can trust the results and route them into remediation. Practitioners should align offensive automation with identity and access governance, not leave it as an isolated security function.

Human researchers are moving up the stack, not out of the process. The article is right to preserve the human role in objective selection, ambiguity handling, and business-context interpretation. That is where offensive security remains differentiated and where risk decisions are actually made. The practical implication is that organisations will need people who can supervise agent fleets, interpret their evidence, and translate findings into access-control and application-hardening priorities. Teams that treat AI as replacement rather than augmentation will misread the operating model.

Named concept: verifiability feedback loops. This is the pattern where repeated, testable actions produce fast evidence that improves the next decision. In application pentesting, that loop is what allows agentic systems to compound capability across discovery, validation, and escalation. The governance lesson is simple: where feedback is strong, automation scales quickly, so security leaders should map which controls can be machine-tested and which require human adjudication.

What this signals

Validation-heavy security work will become the first broad adoption zone for agentic AI. AppSec leaders should expect offensive automation to expand fastest where controls are testable and evidence is clear, then feed those results into remediation pipelines and exposure management programmes. The practical shift is to treat machine-led testing as a continuous input into governance, not a periodic report.

Verifiability feedback loops: the organisations that can define which findings are machine-confirmable will scale offensive coverage faster than peers. That requires clearer ownership between AppSec, IAM, and application teams, plus a tighter mapping from validation evidence to remediation priority.

The broader programme implication is that identity and authorisation boundaries will face more frequent machine testing, which should sharpen how teams measure effective access control. For context on the identity side, practitioners can also use the OWASP NHI Top 10 and the NIST AI Risk Management Framework to frame where agent-driven systems need stronger oversight and review.

For practitioners

• Define which pentest steps can be machine-verified Separate discovery, validation, and interpretation into different control layers so AI handles only the parts with objective evidence and stable success criteria.
• Retire benchmark-only evaluation for offensive agents Use live applications, stateful workflows, and researcher-versus-agent testing instead of relying on public benches that can saturate quickly.
• Tie agent output to IAM and application control owners Route findings on authorization failures, privilege boundaries, and trust-boundary breaks to the teams that own those controls, not only to red-team or AppSec operators.
• Measure false positives and evidence quality together Track not just how often an agent finds issues, but whether the evidence is strong enough for engineering teams to act without rework.

Key takeaways

• AI is already strong in the repeatable parts of application pentesting, where fast feedback and evidence-based validation create compounding gains.
• Benchmark scores alone no longer prove readiness, because real-world pentesting depends on messy state, ambiguity, and control-specific judgment.
• Security teams should let machines handle repetitive validation while keeping humans responsible for objectives, interpretation, and risk decisions.

Key terms

• Continuous verifiability: A governance approach in which an AI agent's legitimacy is checked throughout the session, not only at the point of entry. This helps identity teams detect scope drift, unsafe delegation, and credential misuse before the action completes.
• Benchmark saturation: A condition where many models score so highly on the same test that the ranking no longer meaningfully separates capability. In AI evaluation, saturation usually means the benchmark is too narrow, too familiar, or too easy to game through training exposure.
• Validation-Heavy Security Work: Security tasks that rely on repeated testing, evidence gathering, and immediate confirmation of whether a control failed. This kind of work is unusually suitable for agentic automation because the system can improve through short feedback loops rather than through broad, abstract reasoning.
• Verifiability Feedback Loops: A repeated cycle in which a system acts, observes a clear result, and uses that result to choose the next step. In pentesting, these loops allow AI agents to compound capability across discovery and validation, which is why repeatable attack paths are being automated first.

What's in the full article

FireCompass's full blog covers the operational detail this post intentionally leaves for the source:

• A more granular breakdown of the researcher-versus-agent evaluation method used once public benchmarks saturated
• The progression of agent versions and what changed in tooling, memory, and validation as performance improved
• Specific examples of the control-validation tasks where agents outperformed human researchers
• The operational framing behind under 2% false positives and why that threshold matters for teams using offensive automation

👉 The full FireCompass post covers the version progression, evaluation shift, and human-versus-agent performance details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity control to the broader risk decisions their programmes need to make.