What Is Agentic Pentesting? What It Proves, and Where It Stops.
Picus says agentic pentesting proves exploit chains but misses speed and most of the estate.
Picus, which sells autonomous pentesting, argues agentic testing can confirm individual exploitability and chained paths to critical assets, but only on systems where live exploitation is allowed. It cites 35,364 CVEs in the first half of 2026, only 95 confirmed in-the-wild cases among about 39,600 CVEs through August, and a mean disclosure-to-exploitation time of eight hours in 2026 versus 21.5 days in 2025. A full sweep of a 250,000-endpoint estate can still take weeks and, Picus estimates, may see only 20 to 30 percent of real exploitability. The piece points to Gartner's Continuous Offensive Security Testing model and says exploitability and control validation should complement live pentesting.
- Picus says agentic pentests prove exploitability only on reachable assets.
- Disclosure-to-exploitation time averaged eight hours in 2026, down from 21.5 days.
- Only 95 of about 39,600 CVEs had confirmed exploitation through August.
- A 250,000-endpoint agentic sweep can still take weeks.
- Gartner expects most pentest programs to run continuous validation by 2028.
- Vendors
- Picus
From the original article
6 min read at thehackernews.com
If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, validates, and exploits attack paths autonomously, the way a real attacker would. That promise is worth taking seriously. It’s also worth pressure testing, and three questions do the heavy lifting.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.