State of AI pentesting: adoption, trust, and the future of the pentest

AI is speeding up how software is built, which means more code, more changes, and more chances for vulnerabilities to reach production. It’s speeding up how attackers find and exploit them too, with time-to-exploit now down to a single day. Security testing has to keep pace with both.

AI pentesting has emerged as a way to run in-depth tests whenever teams need them, instead of waiting for the next scheduled pentest. For The State of AI Pentesting 2026, Intruder surveyed 500 security and engineering leaders across the US and UK on whether their testing keeps up with how often they ship, how widely they’ve adopted AI pentesting, and what they need to trust it.

Get the full report or read on for the summary.

How often do organizations pentest compared with how often they ship?

68% of organizations deploy code to production at least daily, and 37% deploy multiple times a day. Understandably, pentests happen far less often. Nearly half (47%) go more than a month between full pentests on their web applications and APIs. That's for each organization's most frequently tested application, so the rest of their estate is tested less often still.

Running a human-led pentest as often as code ships has never been realistic, largely because of the cost. But it means a vulnerability introduced in one release can go weeks or months without a pentest, and only 4% of security leaders believe their current testing frequency gives them sufficient coverage.

Only 4% of security leaders believe their current testing frequency gives them sufficient coverage

How are teams handling the gap between pentests?

Most teams cover it with a mix of approaches, but 42% accept the risk and ship code without additional security checks between pentests. Automated scanning in the build pipeline, more frequent manual pentests, internal AppSec teams, and AI-driven pentesting are each used by around half.

The gap isn’t lost on security leaders. 88% of leaders running scheduled pentests are worried about unmapped risk introduced between tests, and they split almost evenly on how serious it is. Half call it one of their largest unmanaged cyber risks, while the other half describe it as a known gap they're covering with basic perimeter controls.

42% say they accept the risk and ship code without additional security checks between pentests

How widely is AI pentesting being adopted?

55% of organizations already use AI pentesting across their environment, a further 36% have tried it but not yet adopted it at scale, and fewer than 1% have no plans to try it. For a category that has only emerged in the past two years, that's fast uptake.

The largest organizations we surveyed (5,000 to 10,000 employees) have adopted it most widely, with 71% using AI pentesting across their environment.

In the report we also break down adoption by country and sector, including why financial services is among the fastest adopters.

Fewer than 1% have no plans to try AI pentesting

Get the full report

What do security leaders need before relying on AI pentesting?

Mostly, they need to know it’s safe to run and that they can check its work. We asked security leaders what’s holding them back and what would damage their trust. Doubts about quality came further down the list, named by only a quarter. The bigger barriers were about how AI tools operate inside sensitive environments, led by data privacy (40%) and safety on production systems (36%).

Trust mostly comes down to being able to check the work. Nearly half said that not seeing what was tested, or not getting proof that a finding is real, would damage their trust the most. DevSecOps leads are the most skeptical, likely because they work most closely with the findings security tools produce. Only 5% say nothing would damage their trust, compared with 19% of CTOs.

Most of these concerns can be checked before a tool is given access to your code or systems. We've put together the questions worth asking AI pentesting vendors.

Only a quarter see AI testing quality as a top concern

How much time do teams spend validating findings?

More than half of teams (56%) spend six hours or more a week validating findings from their security tooling, and for one in five, it’s more than a full working day. It’s the biggest bottleneck in remediation, slowing teams down more than any other part of the process.

Confirming fixes is slow too. Fewer than two in five organizations retest a fix as soon as it ships, and nearly half take up to two weeks. Until then, there’s no way to know the vulnerability is actually closed.

This is the work AI-enabled validation is designed to cut. It investigates findings from security tooling to confirm which are real and exploitable, so teams don’t have to work it out by hand.

56% of teams spend six or more hours a week triaging false positives

Is the traditional annual pentest dead?

Nine in ten security and engineering leaders agree that the traditional annual pentest is dead and that continuous AI pentesting is now required to keep pace. For most, it already is. Only 6% still rely on a single annual pentest.

Looking three to five years ahead, most (54%) expect AI to handle the bulk of testing, and only one in six expect manual pentests to remain a primary method of security validation. 28% expect to keep manual pentests mainly to satisfy auditors, regardless of their technical value.

90% agree the traditional annual pentest is dead

What this means for security teams

Until now, teams have relied on two kinds of testing, each with a trade-off. Scanning and DAST run often but are generic by design, so they miss flaws specific to how an application works. A pentest goes deep, but it’s a snapshot of how the application looked weeks or months ago. AI pentesting brings the depth of a pentest, on demand, so releases can be tested as they ship and fixes retested straight away.

With AI speeding up how software is built and how it's attacked, AI pentesting makes it possible to keep pace with both. Get the full report for all the findings and join us at the Funeral for the Annual Pentest in London on 22 October. RSVP here.