Topic starter
18/08/2026 2:55 pm
TL;DR: Only 32% of the attack surface is tested on average, with Synack saying AI-era adversaries now move faster than conventional validation cycles. Attack surface coverage then becomes a sampling exercise, so missed chains across identity, cloud and application layers can linger between test cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Synack: “What I Told Security Leaders at Gartner SRM 2026”.
Key questions
Q: Why does more testing create a prioritisation problem?
A: Because discovery scales faster than human triage.
Q: What do teams get wrong about testing agentic AI behaviour?
A: Teams often test the response and ignore the sequence that produced it.
Q: Where does traditional pentesting fail in practice?
A: It fails when validation is periodic while the attack surface is continuous.
Practitioner guidance
- Define live attack-surface coverage targets Set coverage metrics against current asset inventories, cloud accounts, exposed services and critical identity paths so testing tracks change rather than calendar cadence.
- Separate agentic testing from scanner output Require vendors and internal teams to prove that a system can pivot when the first approach fails, then document where human validation remains mandatory.
- Prioritise findings with exploitability context Rank discovered issues using EPSS, KEV status and asset criticality before they enter remediation queues, especially when identity or privileged paths are involved.
Bottom line: Annual pentesting cycles leave too much of the live attack surface outside validation, so the main risk is not just missed vulnerabilities but missed chains across systems.
Glossary terms: Agentic AI, Attack Surface Coverage, Exploitability context, Adaptive Testing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:38 pm
Coverage gap, not raw vulnerability volume, is the real control failure: annual pentesting leaves too much of the live estate outside validation for too long. When only a third of the surface is tested, the organisation is not measuring resilience so much as sampling it. The practitioner conclusion is to treat coverage as an operational control tied to live asset change, not as a periodic assurance exercise.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations use human oversight in AI-assisted pentesting?
A: Human oversight should remain the decision layer for validating attack chains, business logic and whether a finding is truly exploitable. AI can expand reach and speed, but humans still need to judge context, confirm impact and prevent teams from acting on noise instead of risk.
👉 Read our full editorial: Machine-speed adversaries are widening the pentest coverage gap