Security teams ditch AI-only pen testing

A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop.

A year ago, nearly three of every 10 organizations were comfortable letting AI run their penetration testing end to end — no humans required. Today, confidence in that model has collapsed.

Cobalt’s new AI and Pentesting Pulse Report 2026 — based on a survey of 455 cybersecurity professionals — found the share of organizations relying solely on AI automation for testing fell from 29% in 2025 to just 9% this year.

The retreat from full AI automation has a clear cause: 78% of organizations told Cobalt that fully automated AI scanning tools miss critical vulnerabilities and return false negatives. Nearly half of respondents (47%) now back instead a hybrid model that pairs AI testing with human expertise. And applications that employ AI or large language models (LLMs) produce high-risk findings at nearly three times the rate of conventional software, a volume that strains scanners built for a different kind of attack surface.

Cobalt CTO Gunter Ollmann said the diminution of trust in AI-only testing reflects a hard limit in what suchtools can currently understand.

“Experienced penetration testers understand business logic, attacker intent, application context, chained exploitation paths, and subtle trust relationships that current AI systems frequently miss.”
—Gunter Ollmann

Security testing was never just a matter of pattern matching, Ollmann noted, and attackers don’t operate off a fixed rulebook — so defenders shouldn’t assume AI can anticipate every technique, either.

Here’s why teams are shifting back to humans in the loop for penetration testing.

[ See Webinar: Develop a New Playbook for AI-Driven Software Risk ]

Speed without real intelligence

Noelle Murata, a senior security engineer at managed IT provider Xcape, concedes that AI can outrun a human on raw throughput, enumerating a surface and running through basic test cases far faster than a person could. But it can’t adapt, she said. Lacking creativity or experience, AI testing tends to fall back on brute-forcing every permutation of an exploit rather than reasoning its way to the right one. Besides being ineffective, that approach is far more expensive than employing a tester who knows where to look.

Her advice is to let automation build out the attack surface and flag known issues, then hand that information to a human who can connect the dots creatively.

“An AI can find the low-hanging fruit, but due to the noisy nature of trying a bunch of things, it is never going to be as stealthy as a human pen tester. Think about the difference between a script kiddie’ and a professional.”
—Noelle Murata

The remediation bottleneck

Automation’s blind spots aren’t the only problem — what happens after a finding surfaces can be even worse. Cobalt’s earlier state-of-pen testing research found that AI-related findings are classified as high risk more frequently (32% versus 12% of overall findings), yet only 32% of those high-risk findings ever get resolved — the lowest resolution rate of any finding category that Cobalt tracks.

Uzair Gadit, CEO of Secure.com, framed the economics plainly:

“Automated testing loses its value if it simply generates longer lists of unpatchable flaws.”
—Uzair Gadit

Part of the problem is that AI vulnerabilities tend to resist getting fixed by just patching a line of code. Cobalt’s Ollmann noted that closing an AI security gap can mean changing prompts, model behavior, data governance, retrieval systems, agent permissions, application architecture, or business workflow. That's compounded by the wide range of attack methods enabled by AI: prompt injection, insecure model integrations, excessive agent permissions, retrieval-augmented generation weaknesses, sensitive data exposure, insecure tool use, AI supply chain risk, and more. AI has brought so much new to the game that many security teams have had no hope of updating their security practices as fast as users have adopted AI.

Clea Ostendorf, cofounder of Wolfpack Security, noted that while most developers have two decades of SQL injection training behind them, prompt injection, agent permissions, MCP security, and retrieval attacks are still new territory. Worse, no single team owns the problem anymore.

“Security, engineering, infrastructure, data science, legal, and AI platform teams all have a piece. The more people involved, the longer remediation tends to take.”
—Clea Ostendorf

The hybrid advantage

Cobalt CISO Andrew Obadiaru believes LLM vulnerabilities are too context-dependent for tools that lack real architectural understanding of the application being tested. Again, that’s where humans come in. 

“Automation should be deployed exactly where it excels, but elite human expertise remains foundational to uncovering and remediating the most complex business logic risks.”
—Andrew Obadiaru

Li Zhao, a principal strategic services consultant at Black Duck Software, said another reason automated findings still need a human to validate them is operational risk, including system disruption and account lockouts. She frames the hybrid approach as letting AI handle continuous, large-scale reconnaissance, vulnerability discovery, attack-path exploration, and exploit validation while human testers concentrate on business logic flaws, novel attack techniques, and high-risk findings that demand deeper analysis.

"This combination enables broader coverage, more frequent testing, and greater accuracy than either AI-only or human-only approaches."
—Li Zhao

Threat asymmetry

Obadiaru said next-generation Mythos-class AI testing tools should perform better, but he warned that unguided algorithms are still prone to producing more false positives and false negatives than the automated scanners in use today.

Julian Brownlow Davies, senior vice president for offensive security and strategy at Bugcrowd, said organizations aren’t ready to trust unguided next-generation AI testing  — and with reason: If a more capable model is wrong, its error will be harder to catch because it’s wrong more convincingly. But what’s worrying about that is that attackers don’t feel so restrained.

“We bring these tools in slowly — safety reviews, sign-offs, someone accountable if it goes wrong. Threat actors don’t wait for board approval. They just run them.”
—Julian Brownlow Davies

His conclusion is that automation makes human expertise matter more.

AI breaks AppSec assumptions

Denis Calderone, principal and CTO of Suzu Labs, pointed to a deeper problem: AI and LLM functionality is fundamentally at odds with how application security has operated for the last 20 years. Traditional AppSec was about constraining what an application could accept: parameterized queries, stored procedures, input validation designed to reject anything that didn’t match an expected structure. 

AI/LLM systems invert that by design, accepting ambiguous, unstructured natural language and acting on it, which makes conventional input validation nearly meaningless. Worse, these systems typically connect to internal knowledge bases, customer data, and privileged APIs, creating a much larger blast radius than that of a traditional web app scoped to a handful of database tables.

And with AI, testing itself breaks down.

“Traditional software is deterministic: same input, same output. You can write a repeatable test. AI systems are probabilistic. A prompt injection might work three out of 10 times, depending on context, conversation history, or model temperature. That makes both testing and remediation fundamentally harder. You can’t just write a unit test and mark it fixed.”
—Denis Calderone

The path forward

A consensus shared by most experts Cobalt surveyed is that AI testing isn’t being rejected — it’s being rescoped. Automation is staying in the loop for reconnaissance, coverage, and repetitive validation, while the judgment calls — business logic, chained exploits, novel attack paths, and the “why” behind a finding — stay with people who have done this before. 

That rescoping also puts more weight on validating what ships, not just what’s flagged. To that end, binary-level analysis of the artifacts an AI application actually deploys — the compiled code, containers, and dependencies underneath the model — can catch tampering, embedded secrets, and supply chain risk that logic-level pen testing alone was never designed to see.

Jasmine Noel, senior product marketing manager at ReversingLabs, said analysis of the final compiled binary was now critical because several types of cyberattacks that are on the rise can only be found later as software teams approach deployment.

Noel said all components should be tested before you deploy so that you get a complete picture of what you're going to be putting into your runtime — before you run it.

"At that point, you're mainly looking for something malicious that has been embedded in there – malware, or someone has tampered with something and it's behaving strangely. It's that sort of stuff that you want to catch just before you deploy."
—Jasmine Noel