What Is Agentic Pentesting? What It Proves, and Where It Stops.

Summary: Agentic pentesting autonomously discovers, validates, and exploits attack paths, but a full cycle across a 250,000-endpoint estate takes weeks, and live exploitation can only be pointed at part of the environment. The article states autonomous pentesting alone sees perhaps 20 to 30% of real exploitability in a typical enterprise, and cites Gartner's planning assumption that by 2028 over 60% of enterprise pentest programs will operate as continuous validation.
Bottom line: An annual pentest leaves up to a 365-day blind window and weekly automated runs up to seven days, against an eight-hour exploitation window - and the assets skipped for safety, stability or access reasons are exactly where an attacker needs only one gap to succeed.

Read the original at The Hacker News ↗