Topic starter
02/08/2026 11:56 am
TL;DR: Traditional pentesting leaves applications exposed between assessment cycles, while autonomous AI agents can continuously probe, adapt, and validate exploitable paths as code changes, according to Novee. The shift matters because continuous attack simulation changes how teams prioritise risk, validate fixes, and keep pace with modern release velocity.
Editorial analysis by NHI Mgmt Group, based on content published by Novee: “How to Build Continuous AI Security Testing Into Your Engineering Workflow”.
Key questions
Q: How should security teams use automated pentesting in fast-moving application environments?
A: Use automated pentesting for continuous coverage of authenticated flows, API behaviour, and common authorization failures, then reserve manual testing for novel logic, high-value workflows, and ambiguous findings.
Q: Why do broken access control issues survive normal application security testing?
A: They survive because many tools look for patterns inside a single file or repository, while the failure often lives in how multiple functions or services enforce the same rule differently.
Q: What are the signs that an AppSec program is falling behind under modern development pressure?
A: Warning signs include security flaws accumulating faster than teams can fix them, high-severity issues remaining open for months, and large volumes of low-context alerts creating backlog.
Practitioner guidance
- Map autonomous testing to release cadence Run continuous penetration tests on staging and production-adjacent environments every time code, endpoints, or permissions change so results stay current.
- Prioritise exploitability over scan volume Rank findings by whether the agent produced a working proof of concept, not by how many issues the tool generated.
- Test API authorisation paths explicitly Include BOLA, IDOR, and cross-account access checks in every autonomous test plan for user-facing and partner APIs.
Bottom line: Traditional pentesting creates a visibility gap when deployments outpace assessment cycles, and that gap is now large enough to affect release governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:04 pm
Continuous attack simulation is becoming a control, not just a testing method. The article shows why static assessment no longer matches release cadence in modern application environments. Once code, APIs, and integrations change faster than the next pentest window, the security function shifts from periodic verification to continuous validation. For AppSec leaders, that changes governance expectations: risk evidence has to be current enough to support release decisions.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: Should organisations use AI-assisted testing instead of traditional pentests?
A: They should use AI-assisted testing to increase frequency and coverage, but not as a full replacement for expert-led assessments of high-risk systems. The best model is a layered one: automation for continual validation, and deeper human testing where business impact, privilege, or exposure is highest.
👉 Read our full editorial: Autonomous AI penetration testing is reshaping AppSec workflows