Topic starter
02/08/2026 11:22 am
TL;DR: Only 21% validate security on every release even as 76% deploy significant changes weekly or faster, and 48% say findings are outdated on arrival, according to Aikido’s report based on 400 CISOs, CTOs and senior engineering leaders across Europe and the US. Traditional pentesting is being overtaken by release velocity, so continuous validation becomes the practical security question.
Editorial analysis by NHI Mgmt Group, based on content published by Aikido: “2026 State of AI in Pentesting”.
By the numbers:
- Only 21% validate security on every release despite 76% deploying significant changes weekly or faster.
Key questions
A: Security teams should link validation to release events, not to fixed calendar intervals.
Q: Why does AI make traditional pentesting less effective in fast-release environments?
A: AI can increase both the volume and the speed of change, which shortens the window in which a security assessment remains valid.
Q: What are the signs that security validation is lagging behind software delivery?
A: Common signs include findings that are stale by the time engineering receives them, large release volumes between tests, and repeated issues discovered only after deployment.
Practitioner guidance
- Align validation frequency to release cadence Set security validation to trigger on every material release or risk-tiered change, not on a calendar that ignores deployment speed.
- Shift high-risk checks into the delivery pipeline Move automated controls earlier so they evaluate code, dependencies, and configuration before changes reach production.
- Reserve manual pentests for complex attack paths Use human-led testing where business logic, chained privileges, or integration risk demand deeper adversarial reasoning than automation can provide.
Bottom line: Fast release cycles can make security testing obsolete before teams can act on the findings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:40 pm
Release velocity is now a security governance variable, not just a delivery metric. When teams ship weekly or faster, the usefulness of periodic testing declines unless assurance is tied to the same cadence. That shifts pentesting from a standalone event to part of a broader release governance model. Practitioners should treat change velocity as a risk input, not just an engineering KPI.
A question worth separating out:
Q: How do continuous validation and traditional pentesting differ in practice?
A: Traditional pentesting is a point-in-time assessment of a system at a specific moment, while continuous validation evaluates risk as changes move through the pipeline. The difference matters because modern delivery environments change too quickly for a single test cycle to provide durable assurance. Continuous validation does not replace pentesting, but it makes security evidence operationally current.
👉 Read our full editorial: AI is outpacing pentesting in fast-release software delivery