Notifications
Clear all
Topic starter
20/08/2026 5:35 pm
TL;DR: Across 86,310 HTTP requests in 30 API microservice challenges, human testers solved 14 of 30 tasks in two hours while the AI agent identified 230 issues in one hour, underscoring the coverage gap in modern API testing, according to Equixly. The implication is that validation at scale is shifting from tool volume to context-aware exploration, with AI amplifying rather than replacing human judgment.
NHIMG editorial — based on content published by Equixly: AI Penetration Testing, Equixly vs. Humans: Analyzing the Efficiency of AI vs. Human Penetration Testers
By the numbers:
- The AI agent surfaced 230 unique security issues in one hour.
Questions worth separating out
Q: How should security teams test API authorisation beyond a single found vulnerability?
A: Teams should require follow-on enumeration after the first finding, because one broken control often exists in multiple endpoints or roles.
Q: Why do high request volumes not guarantee better penetration testing results?
A: Because request volume measures activity, not coverage or judgment.
Q: What do security teams get wrong about scanner-driven testing?
A: They treat scanner output as proof of security rather than as partial evidence.
Practitioner guidance
- Measure coverage depth, not request count Track how many unique authorisation paths, roles, and object relationships were actually exercised in each test cycle, then compare that with the number of raw requests generated.
- Test repeated flaws across every microservice boundary When one broken access control or injection issue is found, force follow-up enumeration across adjacent endpoints and replicated service patterns.
- Use request cadence and payload analysis as triage signals Combine user-agent fingerprints, inter-request timing, and suspicious payload detection to separate automation from manual exploration, but keep analyst review in the loop before concluding intent.
What's in the full report
Equixly's full blog post covers the operational detail this post intentionally leaves for the source:
- The benchmark methodology behind the 30 microservice challenges and how the test environment was structured.
- The request classification logic used to separate human behaviour from automation, including timing and signature heuristics.
- The suspicious payload distributions that drove the findings, including method-by-method and status-code breakdowns.
- The article's discussion of how hybrid AI and human testing may change secure development workflows.
👉 Read Equixly's analysis of AI-assisted vs human penetration testing on API microservices →
AI-assisted pentesting on API microservices: what teams should note?
Explore further
20/08/2026 6:21 pm
API security validation is moving from request volume to exploit coverage. The article shows that thousands of requests do not automatically translate into meaningful assurance when testers fail to explore stateful logic and recurring access-control mistakes. For application security teams, the relevant metric is whether testing proves or disproves exploitability across the full path, not whether a scanner generated more traffic than a human. Practitioners should treat coverage depth as the real quality signal.
A question worth separating out:
Q: How do teams know if AI-assisted pentesting is actually working?
A: Look for higher-quality findings, faster triage, and fewer unresolved false positives, not just more output. If the workflow still requires manual cleanup to make findings usable, the tool is adding noise rather than improving decision quality. Effective testing should shorten the path from discovery to verified action.
👉 Read our full editorial: AI-assisted pentesting outpaces manual testing on API microservices
