Topic starter
02/08/2026 11:39 am
TL;DR: Continuous web attack-surface coverage now depends on balancing automation depth with human-reviewed assurance for auditors and stakeholders, according to Terra. Riskified’s use of Terra’s agentic AI-driven pentesting shows why the governance issue is no longer whether automation can find more, but whether its outputs remain credible, controlled, and acceptable in regulated programmes.
Editorial analysis by NHI Mgmt Group, based on content published by terra: “Riskified Scales Penetration Testing Depth While Preserving Audit Assurance”.
Key questions
Q: How should security teams govern agentic AI in penetration testing workflows?
A: Security teams should keep agentic AI inside a bounded workflow where scope, tool access, and approval rules are enforced by the testing platform, not the model.
Q: Why do organisations keep human oversight in agentic security testing?
A: Human oversight remains necessary because security testing is not only about speed.
Q: What breaks when penetration testing is automated without validation controls?
A: Findings become harder to trust, easier to dispute, and more difficult to use in formal assurance processes.
Practitioner guidance
- Define the human assurance boundary Specify which pentest outputs require human validation, human sign-off, and human-signed reporting before they can be used in audits or formal assurance packs.
- Separate depth from evidence quality Measure whether the testing programme produces reproducible exploit evidence, not just a higher volume of findings or broader surface coverage.
- Align pentest cadence to release velocity Schedule continuous or recurring testing so new web application paths, APIs, and integrations are validated soon after they change.
Bottom line: Agentic AI can extend penetration testing depth across fast-changing web surfaces, but that output only becomes usable assurance when humans validate scope, exploitability, and report quality.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:51 pm
Agentic pentesting creates an evidence-governance problem, not just a testing problem. The article makes clear that the value proposition is broader coverage, but the governance challenge is whether the output can be accepted as audit evidence. Once penetration testing becomes continuous and AI-directed, the quality bar shifts from finding issues to proving that findings were bounded, validated, and suitable for regulated review. Practitioners should treat evidence integrity as part of the control design.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
A: Continuous offensive testing runs repeatedly and adapts as systems change, so it can follow new releases, new features, and changing exposure. Traditional penetration testing is a snapshot of a specific moment. The practical difference is that continuous testing supports ongoing decision-making, while point-in-time testing mainly supports periodic assurance and compliance reporting.
👉 Read our full editorial: Agentic ai pentesting needs human assurance to satisfy audit demands