Topic starter
18/08/2026 2:41 pm
TL;DR: Security teams discover high or critical vulnerabilities outside scheduled testing windows 95% of the time, and 79% will not act on AI-generated findings without human validation, according to Synack’s early research. The data suggests continuous security validation is becoming a distinct operating model because cadence alone no longer matches the speed of modern attack surfaces.
Editorial analysis by NHI Mgmt Group, based on content published by Synack: “The State of Continuous Security Validation: An Early Look at the Data”.
By the numbers:
- 79% would not act on an AI-generated finding without human validation.
Key questions
Q: What fails when security testing stays on a fixed schedule?
A: Fixed schedules fail when exposure changes faster than the next test window.
Q: Why do organisations still need human validation after AI-assisted pentesting finds issues?
A: Human validation matters because automated findings only help if they are truly exploitable, understandable, and actionable.
Q: What signs show that validation coverage is lagging behind change?
A: The clearest signs are recurring high-severity findings between scheduled tests, repeated surprises after deployments, and a backlog of issues that were assumed to be covered already.
Practitioner guidance
- Map validation to change events Tie validation runs to releases, infrastructure changes, privilege changes, and new external exposures instead of relying only on quarterly or monthly schedules.
- Separate AI triage from human sign-off Use AI to prioritise candidate issues, then require a human to confirm exploitability, impact, and business relevance before remediation starts.
- Define closure criteria for continuous validation Require retesting after remediation and record the condition that proves exposure is no longer present, rather than treating a ticket as closure.
Bottom line: The central problem is not lack of testing, but the delay between environmental change and the next validation cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Continuous validation is becoming the relevant unit of assurance. Point-in-time testing no longer maps cleanly to environments that change by the hour. Security leaders should treat exposure confirmation as a live control, not a quarterly event, because stale assurance creates a false sense of coverage.
A question worth separating out:
Q: How should security leaders govern continuous validation programs?
A: They should treat continuous validation as a control loop with ownership, triggers, human review, and re-validation after remediation. That means defining when testing runs, who validates the finding, what counts as closure, and how live identity and access changes feed into scope. The programme must be managed as an operational control, not a report.
👉 Read our full editorial: Continuous security validation is outpacing periodic testing models