-
Nine in 10 security and engineering leaders say the traditional annual pentest is dead, and continuous AI pentesting is now required to keep pace with how quickly organizations ship code
-
Only 4% say their testing frequency gives them sufficient coverage, while 42% accept the risk and ship code without additional security checks between pentests
-
92% have tried or adopted AI pentesting; data privacy (40%) and production safety (36%) are bigger barriers than testing quality (25%)
Intruder, a leader in exposure management, released The State of AI Pentesting in 2026, examining how software development has outpaced traditional security testing. The report is based on a survey of 500 U.S. and U.K. security and engineering leaders and finds that nine in 10 leaders now consider the annual pentest obsolete.
Also Read: CIO Influence Interview with Srinivasan Panchapakesan, Chief Platform Officer at Hexaware
AI is speeding up software development, with 68% of organizations deploying code at least daily and 37% deploying multiple times a day. Pentesting hasn’t kept pace: 47% of organizations go more than a month between full pentests on their web applications and APIs, and just 1% test on every major release. That window between tests has always existed, but it’s riskier now that AI is helping attackers find and exploit vulnerabilities faster.
“AI has permanently altered both the volume of code going into production and the speed at which attackers can exploit flaws,” said Chris Wallis, CEO and founder of Intruder. “To close the exposure gap, security validation must become as continuous and automated as the pipelines building the code. The annual pentest may be dead, but the need for continuous validation has never been more real.”
Known risk, shipped anyway
Among leaders running scheduled pentests, 88% worry about unmapped risk introduced between tests. Even so, 42% accept the risk and ship code without additional security checks.
Teams also lose time on manual validation, with 56% spending six hours or more a week triaging, validating or dismissing false positives and non-exploitable findings. One in five (21%) spend 11 hours or more, longer than a full working day.
Even after a fix ships, validation can take time. Fewer than two in five organizations independently retest a fix in production as soon as it ships, and nearly half take up to two weeks.
Adoption is broad, but trust depends on transparency
Nearly all organizations (92%) have tried or adopted AI pentesting, and 55% use it across their environment. Few doubt the quality of AI testing: only 25% name its depth compared with human testers as a top barrier. The bigger concerns are how AI tools operate inside sensitive environments. 40% cite data privacy, 36% cite safety on production systems and 28% question whether auditors and regulators will accept AI-generated reports.
Trust comes down to being able to check the work. Nearly half (46%) say the thing that would most damage their trust in AI pentesting is a lack of visibility into what was tested (25%) or a lack of reproducible proof of exploitability (21%).
The midmarket squeeze
Organizations with 1,000 to 4,999 employees appear to be under the most pressure. They deploy as often as the largest companies, usually with smaller security teams. They are also the least likely to pentest at least monthly (47%), and half accept the risk and ship code without additional checks between pentests.
Midmarket organizations have tried AI pentesting at the same rate as the largest organizations, but they have scaled it less: 54% use it across their environment, compared with 71% of organizations with 5,000 to 10,000 employees. Only 4% of midmarket organizations say they face no major barriers to adoption. These findings echo Intruder’s Security Middle Child report, where 42% of midmarket teams described themselves as stretched, overwhelmed, or consistently behind.
Catch more CIO Insights: The Overlooked Security Risk Behind Enterprise AI Rollouts
[To share your insights with us, please write to psen@itechseries.com ]
