AI agent pentesting economics: what it means for security teams

TL;DR: Continuous offensive testing is becoming materially cheaper, with an AI agent reaching top-three positions on HackerOne during a quarter-long experiment at about $5,000 a month, according to FireCompass. With 12.7% of 150 reports accepted and 64.4% of severity-rated findings classed as critical or high, the real constraint is no longer discovery capacity alone, but governance, validation, and submission speed.

NHIMG editorial — based on content published by FireCompass: How FireCompass AI Agents Reached HackerOne’s Top 3 on $5,000 a Month: Full Methodology, Data, and Limitations

By the numbers:

• Critical and high-severity issues made up 64.4% of the 101 severity-rated reports.
• The not-applicable rate was 4.0% overall, which FireCompass presents as evidence of precision rather than scanner-style noise.

Questions worth separating out

Q: How should security teams govern AI agents used for offensive testing?

A: Treat offensive AI agents as distinct workloads with explicit ownership, scoped tools, and logged approvals.

Q: Why do AI-driven penetration tests change the economics of security assurance?

A: They reduce the cost of continuous testing from scarce specialist time to governed compute, which makes frequent validation practical for more assets.

Q: What usually fails when autonomous testing agents are not tightly controlled?

A: Scope control and execution discipline fail first.

Practitioner guidance

• Assign the agent a formal identity and owner Treat offensive AI tooling as a privileged non-human identity with a named owner, documented scope, and explicit approval path before it can touch live targets.
• Enforce scope and blast-radius limits in policy Hard-block out-of-scope hosts, cap request velocity per target, and default-write operations to deny so the agent cannot create unsafe load or unintended changes.
• Require proof of exploit before submission Only allow findings into remediation workflow after validation confirms reproducibility, scope fit, and evidence quality suitable for triage.

What's in the full article

FireCompass's full post covers the operational detail this post intentionally leaves for the source:

• The quarter-by-quarter methodology behind the HackerOne run, including how the pipeline handled scope ingestion, human triage, and disposition tracking.
• The complete report taxonomy, including how duplicates, informative submissions, and pending findings were classified across the experiment window.
• The engineering choices behind model routing, validation agents, and rate-limiting controls that kept the agent within published scope.
• The specific examples of high-critical findings, which show the attack classes the system surfaced in practice.

👉 Read FireCompass's methodology on AI agents reaching HackerOne's top three →

AI agent pentesting economics: what it means for security teams?

Explore further

View Full Forum →  |  NHI Foundation Course →