If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, validates, and exploits attack paths autonomously, the way a real attacker would.

That promise is worth taking seriously. It’s also worth pressure testing, and three questions do the heavy lifting.

Most evaluations stop at the first step. However, it’s at the second and third ones where validation programs are won or lost.

One note on where we stand: Picus builds and sells autonomous pentesting. That is exactly why we can be precise about where it ends, because the limits belong to the method, not to any vendor's implementation, and no roadmap can remove them.

Four numbers from this year explain why the second and third questions now carry more weight than the first.

You can’t patch, schedule, or predict your way out. You validate, on evidence, within hours of the change that demanded it. Yet an annual pentest leaves as much as a 365-day blind window between a change and the next test, and weekly automated runs still leave a gap of up to seven days.

Gartner has drawn the conclusion formally: its Continuous Offensive Security Testing (COST) model replaces the point-in-time assessment with trigger-driven , risk-tiered testing completed within risk-aligned timeframes , often minutes or hours, with a planning assumption that by 2028 over 60% of enterprise pentest programs will operate as continuous validation.

Source link