Intruder has released ‘The State of AI Pentesting in 2026’, which claims that software development has outpaced traditional security testing. The report is based on a survey of 500 US and UK security and engineering leaders and finds that nine in ten leaders now consider the traditional annual penetration test obsolete.
AI is speeding up software development, with 68% of organizations deploying code at least daily and 37% deploying multiple times a day. Penetration testing hasn’t kept pace: 47% of organizations go more than a month between full penetration tests on their web applications and APIs; and just 1% test on every major release. That window between tests has always existed, but it’s riskier now that AI is helping attackers find and exploit vulnerabilities faster.
“AI has permanently altered both the volume of code going into production and the speed at which attackers can exploit flaws,” said Chris Wallis, CEO and founder of Intruder. “To close the exposure gap, security validation must become as continuous and automated as the pipelines building the code. The annual pentest may be dead, but the need for continuous validation has never been more real.”
Among leaders running scheduled penetration tests, 88% worry about unmapped risk introduced between tests. Even so, 42% accept the risk and ship code without additional security checks.
Teams also lose time on manual validation, with 56% spending six hours or more a week triaging, validating, or dismissing false positives and non-exploitable findings. One in five (21%) spend 11 hours or more.
Even after a fix ships, validation can take time. Fewer than two in five organizations independently retest a fix in production as soon as it ships, and nearly half take up to two weeks.
Adoption of AI penetration testing
Nearly all organizations (92%) have tried or adopted AI penetration testing and 55% use it across their environment.
Concerns raised include how AI tools operate inside sensitive environments: 40% cite data privacy concerns, 36% cite safety issues on production systems, and 28% question whether auditors and regulators will accept AI-generated reports.
Trust comes down to being able to check the work. Nearly half (46%) say the thing that would most damage their trust in AI penetration testing is a lack of visibility into what was tested (25%) or a lack of reproducible proof of exploitability (21%).
Methodology
‘The State of AI Pentesting in 2026’ report is based on an independent survey conducted by Censuswide in September 2026, surveying 500 security and engineering decision-makers (including CTOs, CISOs, VPs of engineering, and DevSecOps leads) across the US (60%) and UK (40%) in companies ranging from 250 to 10,000 employees.
