The Blind Spots of Agentic Pentesting and How to Close Them

Picus says agentic pentesting misses unreachable assets and flaws that lack safe exploits.

A Picus Security research engineer argues that agentic penetration testing is creative but inconsistent, token-expensive, and limited to assets it can safely reach. Omdia found organizations pentest about 32% of their attack surface, while safety and segmentation leave critical or isolated systems untested. In one customer environment, scanners found nginx-ui authentication bypass CVE-2026-33032 on 480 instances, but agentic testing could assess only 120 and confirmed 80 exploitable. VulnCheck reported that only about a quarter of 2025 CVEs had proof-of-concept code, so Picus advocates control-based exploitability validation alongside deterministic and agentic testing.