The state of AI pentesting in 2026

Nine in 10 security and engineering leaders consider the traditional annual pentest obsolete and require continuous AI pentesting to keep pace with how quickly organizations ship code.

42% of security and engineering leaders accept the risk and ship code without additional security checks between pentests.

92% of security and engineering leaders have tried or adopted AI pentesting.

40% of security and engineering leaders cite data privacy as a top barrier to AI pentesting.

36% of security and engineering leaders cite safety on production systems as a top barrier to AI pentesting.

25% of security and engineering leaders name the depth of AI testing compared with human testers as a top barrier.

68% of organizations deploy code at least daily.

37% of organizations deploy code multiple times a day.

47% of organizations go more than a month between full pentests on their web applications and APIs.

Only 1% of organizations test on every major release.

Among leaders running scheduled pentests, 88% worry about unmapped risk introduced between tests.

56% of organizations spend six hours or more per week triaging, validating, or dismissing false positives and non-exploitable findings.

21% of organizations spend 11 hours or more per week triaging, validating, or dismissing false positives and non-exploitable findings.

Fewer than two in five organizations independently retest a fix in production as soon as it ships.

55% of organizations use AI pentesting across their environment.

28% of security and engineering leaders question whether auditors and regulators will accept AI-generated reports.

25% of security and engineering leaders say a lack of visibility into what was tested would most damage their trust in AI pentesting.

21% of security and engineering leaders say a lack of reproducible proof of exploitability would most damage their trust in AI pentesting.

Only 4% of security and engineering leaders say their testing frequency gives them sufficient coverage.