The Blind Spots of Agentic Pentesting and How to Close Them

Summary

Picus Security researcher Sila Ozeren Hacioglu argues that agentic pentesting, where AI agents run tests step by step, finds complex exploit chains faster than humans but leaves blind spots. The article says safety restrictions and network limitations keep many assets and vulnerabilities untested, and that combining agentic pentesting with exposure validation and breach simulation can help close those gaps. It notes that agentic runs are costly and vary between runs, and that Omdia research found organizations pentest only 32% of their attack surface on average.

Mitigation

Combine agentic pentesting with exposure validation and breach simulation, and run deterministic automated pentests often alongside agentic tests at set intervals.

Topics

• AI agents