Notifications
Clear all
Topic starter
19/08/2026 3:39 pm
TL;DR: 64% of organisations prefer agent-led pentesting with human oversight, while 87% report high or complete trust in agentic AI and 69% require at least 85% accuracy before using it in production, according to Synack’s commissioned Omdia study. The data suggests security teams are treating explainability, guardrails, and human validation as governance requirements, not optional features.
NHIMG editorial — based on content published by Synack: The New Standard: Why 64% of Firms Prefer Human-Validated AI Pentesting
By the numbers:
- 64% of organisations identify agent-led with human oversight as their preferred operational model.
Questions worth separating out
Q: How should security teams govern agentic pentesting tools in production-like environments?
A: Treat them as delegated systems with explicit scope, named ownership, and approval checkpoints.
Q: Why do organisations keep human oversight in agentic security testing?
A: Human oversight remains necessary because security testing is not only about speed.
Q: What breaks when agentic AI testing is allowed to run without strong guardrails?
A: Without guardrails, an AI testing system can exceed scope, use unsafe commands, or generate findings that cannot be trusted.
Practitioner guidance
- Define the agent’s scope as a privileged access policy Document which assets, test types, and commands an AI pentesting system may use, and require explicit approval for anything outside that boundary.
- Require proof-based validation before findings reach remediation Only allow findings into ticketing or reporting workflows when they include independent re-test evidence, exploit confirmation, and a clear explanation of why the result is credible.
- Add human sign-off for destructive or high-impact actions Block commands or actions that could delete data, alter systems, or disrupt production unless a human reviewer explicitly approves the test path.
What's in the full report
Synack's full research covers the operational detail this post intentionally leaves for the source:
- Survey methodology and respondent mix behind the 64% oversight preference and 87% adoption figures
- Breakdown of how production users define acceptable accuracy, transparency, and guardrail thresholds
- Examples of the agent-led testing model, including verification workflow and human review steps
- FAQ-level detail on Sara Pentest and Sara Triage capabilities for teams evaluating implementation
👉 Read Synack's analysis of human-validated agentic AI pentesting →
Human-validated AI pentesting: what changes for security teams?
Explore further
19/08/2026 4:19 pm
Human oversight is becoming the control boundary for agentic security testing. The article shows that organisations are not adopting AI testing as an autonomy problem, they are adopting it as a supervised operations problem. That is the right instinct. In security testing, the value of automation collapses if the output cannot be defended, explained, and independently verified. Practitioners should treat the oversight layer as part of the control plane, not a temporary concession.
A question worth separating out:
Q: Who is accountable when an AI system used for security testing crosses into abuse?
A: Accountability sits with the organisation that grants access, defines scope, and approves the workflow. That usually includes security leadership, platform owners, and the teams managing the AI toolchain. If a model can act on behalf of a business process, the business must control the identity, permissions, and audit trail behind it.
👉 Read our full editorial: Human-validated AI pentesting is becoming the new operating model
