79% will not act on AI-generated findings without human validation, while only 15% describe their security testing and validation programs as continuous
Synack, which offers the first truly AI-powered continuous pentest for enterprises, today published The State of Continuous Security Validation, a market study of enterprise security leaders and practitioners. The research found that 95% discovered high or critical vulnerabilities outside scheduled testing windows in the past year, including 42% who did so at least monthly. The findings expose a growing gap between the speed of change in enterprise environments and the cadence of point-in-time testing.
The research highlights three connected challenges:
- Coverage gap: 38% said at least one-quarter of their critical attack surface had not been independently tested or validated in the previous 90 days.
- AI trust gap: 79% would not act on an AI-generated finding without human validation.
- Maturity gap: Only 15% described their security testing and validation program as continuous.
Security leaders described the real-world consequences in their own words: “It simply means we operate with a constant blind spot, where new code changes run in production for days or weeks before they are finally validated.” —CISO/CSO, enterprise respondent
Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX
AI Expands Coverage. Humans Prove What Matters.
The study shows strong interest in AI-assisted security testing, but not in AI operating without human judgment. Respondents expect AI to play a major role in scaling reconnaissance, finding potential vulnerabilities and expanding testing coverage. Human expertise remains central to validating exploitability, assessing severity and business risk, testing complex workflows, reducing false positives, and communicating risk to stakeholders.
“Point-in-time testing is reaching its limit because the environment changes faster than a scheduled test can represent,” said Angela Heindl-Schober, Chief Marketing Officer at Synack. “The market direction is clear: AI expands coverage, humans prove exploitability, and security validation becomes continuous. The gap is not awareness. It is execution.”
Continuous pentesting or validation was the leading method respondents named for confirming whether a finding is exploitable, at 22%. Yet only 15% would describe the maturity of their overall program as continuous. The most common barriers to achieving continuous security validation centered around compliance-driven test cycles, integration complexity, lack of trust in automated findings, false positives, difficulty proving ROI, and unclear ownership across teams.
“Automation can surface more signals, but security teams need evidence, not noise,” said Mark Kuhr, Co-Founder and Chief Technology Officer at Synack. “Human researchers bring the creativity and context to chain weaknesses, confirm exploitability and show what an attacker can actually do.”
A Human + AI Model for Continuous Security Validation
The findings reinforce the need for a Human + AI approach to continuous security validation. Sara AI Pentesting uses the Synack Autonomous Red Agent to expand reconnaissance and testing at scale, while the Synack Red Team brings rigorously vetted human expertise to validate real-world exploitability, identify chained attack paths, and provide the context automation cannot replicate. Together, they help organizations move beyond periodic snapshots toward continuous security validation.
Catch more CIO Insights: What Does “Job-Ready” Really Mean in IT and Cybersecurity?
[To share your insights with us, please write to psen@itechseries.com ]
