Topic starter
18/08/2026 2:55 pm
TL;DR: Security leaders are testing only 32% of their attack surface on average while 68% remains untested, according to Synack’s Gartner SRM 2026 commentary, which argues that AI-era adversaries now move on a much faster clock than conventional validation cycles. Human oversight remains essential because agentic systems can chain vulnerabilities, but current programmes still struggle to distinguish real adaptive capability from automated scanning and polished reporting.
Editorial analysis by NHI Mgmt Group, based on content published by Synack: “What I Told Security Leaders at Gartner SRM 2026”.
Key questions
Q: Where does traditional pentesting fail in practice?
A: It fails when validation is periodic while the attack surface is continuous.
Q: Why does more testing create a prioritisation problem?
A: Because discovery scales faster than human triage.
Q: What do teams get wrong about testing agentic AI behaviour?
A: Teams often test the response and ignore the sequence that produced it.
Practitioner guidance
- Define live attack-surface coverage targets Set coverage metrics against current asset inventories, cloud accounts, exposed services and critical identity paths so testing tracks change rather than calendar cadence.
- Separate agentic testing from scanner output Require vendors and internal teams to prove that a system can pivot when the first approach fails, then document where human validation remains mandatory.
- Prioritise findings with exploitability context Rank discovered issues using EPSS, KEV status and asset criticality before they enter remediation queues, especially when identity or privileged paths are involved.
Bottom line: Annual pentesting cycles leave too much of the live attack surface outside validation, so the main risk is not just missed vulnerabilities but missed chains across systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:38 pm
Coverage gap, not raw vulnerability volume, is the real control failure: annual pentesting leaves too much of the live estate outside validation for too long. When only a third of the surface is tested, the organisation is not measuring resilience so much as sampling it. The practitioner conclusion is to treat coverage as an operational control tied to live asset change, not as a periodic assurance exercise.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations use human oversight in AI-assisted pentesting?
A: Human oversight should remain the decision layer for validating attack chains, business logic and whether a finding is truly exploitable. AI can expand reach and speed, but humans still need to judge context, confirm impact and prevent teams from acting on noise instead of risk.
👉 Read our full editorial: Machine-speed adversaries are widening the pentest coverage gap