Topic starter
18/08/2026 2:33 pm
TL;DR: Only 32% of enterprise attack surfaces are tested on average, leaving a 68% blind spot that attackers can exploit at machine speed, according to Synack’s Omdia-backed survey. Agentic AI expands coverage and testing frequency, but human validation remains necessary for business logic flaws, IDOR, and safe use in high-assurance environments.
Editorial analysis by NHI Mgmt Group, based on content published by Synack: “Why the Future of Pentesting Needs Humans and Agentic AI Working Together”.
Key questions
Q: What breaks when pentests are only point-in-time assessments?
A: Coverage becomes stale the moment the application changes.
A: AI pentesting agents still need human oversight because success in bug bounty work depends on judgment, scoping, evidence quality, and knowing when to stop.
Q: What are the signs that AI-driven pentesting is being over-trusted instead of properly engineered?
A: Common warning signs include high false-positive rates, inconsistent results across repeated runs, loss of attack context after long sequences, and reports that lack reproducible evidence.
Practitioner guidance
- Implement continuous attack-surface testing Use agentic AI to keep enumerating and rechecking exposed assets between manual exercises so testing is not limited to snapshots.
- Route high-risk findings to human validation Require a human tester to confirm exploitability for business logic flaws, IDOR, and multi-step access control chains before reporting.
- Enforce hard scope containment Limit AI testing to approved zones with network-level boundaries, especially in high-assurance or critical infrastructure environments.
Bottom line: Agentic AI pentesting can close large parts of the coverage gap, but only if humans remain responsible for validating exploitability and context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:20 pm
Coverage is now the governance problem, not just test cadence. A pentest program that covers only a third of the environment is not merely under-resourced, it is structurally blind to the areas most likely to be abused between engagements. That changes the identity of the control itself: pentesting is no longer a periodic activity, but a continuous governance function. For teams running IAM and NHI-heavy environments, the issue is especially acute because access logic changes faster than annual testing cycles. The practitioner conclusion is simple: assurance has to move closer to runtime.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams use agentic testing without over-relying on automation?
A: Security teams should use agentic testing to expand coverage, speed up discovery, and reduce repetitive triage, but keep humans responsible for interpreting business impact and validating the most sensitive paths. The right model is machine-assisted assurance, where automation improves cadence and consistency while expert judgement handles chaining, edge cases, and remediation decisions.
👉 Read our full editorial: Human and agentic AI pentesting must close the coverage gap