Notifications
Clear all
Topic starter
18/08/2026 2:10 pm
TL;DR: Asset change outpaced manual assessment, pushing Dow from point-in-time testing to continuous coverage, according to Synack, while AI pentesting proved expensive to build in-house once engineering, token use, harnessing, and human validation were counted. The deeper lesson is that the wrapper around an agent matters more than the model itself, and governance still has to decide what is actually exploitable.
NHIMG editorial — based on content published by Synack: Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack
Questions worth separating out
Q: How should security teams decide whether to build or buy AI pentesting capabilities?
A: Teams should compare the full operating cost, not just the first prototype.
Q: Why do application security tools still need human validation?
A: Because a scanner can identify unusual behaviour, but it cannot reliably decide whether the behaviour is intended, tolerated, or exploitable in your organisation.
Q: What do security teams get wrong about agentic pentesting swarms?
A: They often assume more agents automatically means better coverage.
Practitioner guidance
- Automate asset handoff into pentest queues Connect discovery output for cloud storage, forgotten subdomains, and other newly exposed assets to the testing workflow so coverage follows the live attack surface rather than a calendar.
- Require a harness-defined rules of engagement layer Encode action limits, scope boundaries, and decision thresholds in the orchestration layer before any model is allowed to interact with targets.
- Keep human validation before remediation routing Review candidate findings for exploitability, duplication, and compensating controls before they move into downstream fix tracking or executive reporting.
What's in the full article
Synack's full article covers the operational detail this post intentionally leaves for the source:
- How Dow operationalised continuous pentesting against newly exposed assets and changing web-facing environments
- How Synack structured Sara AI Pentesting as a harnessed swarm rather than a single general-purpose agent
- How token usage, engineering effort, and maintenance overhead shaped the build-versus-buy decision
- How human validation is inserted into the workflow before findings reach downstream teams
👉 Read Synack's analysis of Dow's build-vs-buy decision for AI pentesting →
AI pentesting build vs buy: what matters for security teams?
Explore further
18/08/2026 3:03 pm
Continuous validation is becoming the real security control, not a periodic test. When attack surfaces expand faster than formal review cycles, point-in-time pentesting leaves blind spots that governance cannot explain away. Continuous testing aligns better with modern cloud and application change rates, but only if the workflow is tied to asset discovery and prioritisation. The practitioner conclusion is that coverage cadence now matters as much as scanner depth.
A question worth separating out:
Q: How can organisations govern AI-assisted testing without losing speed?
A: Use policy to separate candidate generation from decision-making. Let the agent gather evidence and propose findings, then require a human or approved workflow to confirm exploitability, deduplicate results, and route remediation. That preserves speed while keeping reporting, triage, and accountability under control.
👉 Read our full editorial: Continuous AI pentesting exposes the real build-vs-buy trade-off
