Nine in 10 security and engineering leaders say the traditional annual pentest is dead, and continuous AI pentesting is now required to keep pace with how quickly organizations ship code
Only 4% say their testing frequency gives them sufficient coverage, while 42% accept the risk and ship code without additional security checks between pentests
92% have tried or adopted AI pentesting; data privacy (40%) and production safety (36%) are bigger barriers than testing quality (25%)

Intruder, a leader in exposure management, today released The State of AI Pentesting in 2026, examining how software development has outpaced traditional security testing. The report is based on a survey of 500 U.S. and U.K. security and engineering leaders and finds that nine in 10 leaders now consider the annual pentest obsolete.

AI is speeding up software development, with 68% of organizations deploying code at least daily and 37% deploying multiple times a day. Pentesting hasn’t kept pace: 47% of organizations go more than a month between full pentests on their web applications and APIs, and just 1% test on every major release. That window between tests has always existed, but it’s riskier now that AI is helping attackers find and exploit vulnerabilities faster.

“AI has permanently altered both the volume of code going into production and the speed at which attackers can exploit flaws,” said Chris Wallis, CEO and founder of Intruder. “To close the exposure gap, security validation must become as continuous and automated as the pipelines building the code. The annual pentest may be dead, but the need for continuous validation has never been more real.”

Known risk, shipped anyway

Among leaders running scheduled pentests, 88% worry about unmapped risk introduced between tests. Even so, 42% accept the risk and ship code without additional security checks.

Teams also lose time on manual validation, with 56% spending six hours or more a week triaging, validating or dismissing false positives and non-exploitable findings. One in five (21%) spend 11 hours or more, longer than a full working day.

Even after a fix ships, validation can take time. Fewer than two in five organizations independently retest a fix in production as soon as it ships, and nearly half take up to two weeks.

Adoption is broad, but trust depends on transparency

Nearly all organizations (92%) have tried or adopted AI pentesting, and 55% use it across their environment. Few doubt the quality of AI testing: only 25% name its depth compared with human testers as a top barrier. The bigger concerns are how AI tools operate inside sensitive environments. 40% cite data privacy, 36% cite safety on production systems and 28% question whether auditors and regulators will accept AI-generated reports.

Trust comes down to being able to check the work. Nearly half (46%) say the thing that would most damage their trust in AI pentesting is a lack of visibility into what was tested (25%) or a lack of reproducible proof of exploitability (21%).

The midmarket squeeze

Organizations with 1,000 to 4,999 employees appear to be under the most pressure. They deploy as often as the largest companies, usually with smaller security teams. They are also the least likely to pentest at least monthly (47%), and half accept the risk and ship code without additional checks between pentests.

Midmarket organizations have tried AI pentesting at the same rate as the largest organizations, but they have scaled it less: 54% use it across their environment, compared with 71% of organizations with 5,000 to 10,000 employees. Only 4% of midmarket organizations say they face no major barriers to adoption. These findings echo Intruder's Security Middle Child report, where 42% of midmarket teams described themselves as stretched, overwhelmed, or consistently behind.

The full report is available here. Intruder will host a live, in-person event in London, UK marking the "Funeral for the Annual Pentest" on Thursday, Oct. 22, 2026. Details on how to register are at pentestingisdead.com.

Methodology

The State of AI Pentesting in 2026 report is based on an independent survey conducted by Censuswide in September 2026, surveying 500 security and engineering decision-makers (including CTOs, CISOs, VPs of Engineering, and DevSecOps Leads) across the US (60%) and UK (40%) in companies ranging from 250 to 10,000 employees.

FAQs

What does “continuous pentesting” actually mean?

The industry hasn't agreed. 96% of organizations call continuous pentesting a priority, and more than a third say they've achieved it. Yet when Intruder offered four common definitions, no single one was chosen by more than 35% of respondents. As a result, "continuous" can describe very different levels of coverage, so buyers should ask vendors exactly what is tested and how often.

Do organizations still need manual pentests if they use AI pentesting?

Increasingly not. Most security leaders in Intruder's research expect AI to handle the bulk of testing within three to five years, and only one in six expect manual pentests to remain a primary validation method. Where manual testing stays, respondents expect it to be for specialized work such as red teaming and social engineering, or for compliance, with 28% planning to keep manual pentests mainly to satisfy auditors.

Which organizations are adopting AI pentesting fastest?

U.S. organizations lead: 64% use AI pentesting across their environment, compared with 42% in the U.K. By sector, professional services (64%) and financial services (63%) lead, while manufacturing trails at 39%. Financial services also ship faster than most industries, with 46% deploying multiple times a day, according to Intruder's research.

About Intruder

Intruder's exposure management platform helps lean security teams stop breaches before they start by proactively discovering attack surface weaknesses. By unifying AI penetration testing, attack surface management, cloud security and continuous vulnerability management in one intuitive platform, Intruder makes it easy to stay secure by cutting through the noise and complexity. Founded in 2015 by Chris Wallis, a former ethical hacker turned corporate blue teamer, Intruder is now protecting over 3,000 companies worldwide. Learn more at https://intruder.io and get real-time threat intelligence at https://cvemon.intruder.io.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261013139678/en/

Media Contact
Treble
Katie Anne Hayes
intruder@treblepr.com

Tags

More Like This

Intruder Announces AI Pentesting for Web Applications

Intruder Announces AI Pentesting: Delivering The Depth of a Pentest, On-Demand

95% of Enterprises Prioritize Pentesting, Yet Only 32% of Attack Surfaces Are Tested, New Synack and Omdia Research Finds

BUILDING STRONGER SECURITY BY THINKING LIKE AN ATTACKER

Pentera's Report on the State of Pentesting in the UK Reveals Rapid Shift to Software-Based Security Validation

Intruder CEO Chris Wallis to Discuss AI and the Future of Pentesting at KB4-CON 2026

YesWeHack Launches Agentic Pentest for AI Security Testing

Synack CTO to Present Five Tests for Production-Ready AI Pentesting at Gartner® Security & Risk Management Summit