Autonomy Was Never the Goal

The pitch for fully autonomous penetration testing is not subtle, and you do not have to take my characterization of it. One vendor describes having earned “the right to autonomously pentest the most critical and sensitive networks, with no humans in the loop.” Another says its product “requires no human input.” A third says its agents “have beaten human pentest teams head-to-head.” Someone has trademarked the phrase “the World’s Best AI Hacker.”

Investors have put hundreds of millions of dollars behind that sentence in the past two years.

Today, NetSPI and Synack announced a definitive agreement to merge. I want to be direct about what we just did, because it is the opposite trade. We are combining two of the deepest benches of human offensive security talent in the industry at the precise moment the market decided that talent was the expensive part worth engineering away.

That is not a hedge. That is the thesis.

The Peer-Reviewed Answer Is Already In

Let me start by conceding the strongest point on the other side, because it is real and it is not small.

AI agents have become dramatically better at hacking competitions. Benchmarking published in April of this year put Claude 4.5 Opus at 59 percent on the 200 challenges in NYU CTF Bench, with Gemini 3 Pro at 52 percent. Two years ago, agents in that class were scoring under 20 percent. Anyone telling you the capability curve is flat is not paying attention.

Now move the target. That is where the argument actually lives.

In June, researchers at Fudan University published AgentCyberRange, which put six frontier systems, including GPT-5.5 with Codex and Claude Opus 4.7, against 110 vulnerabilities across 15 real web applications and 8 enterprise-like cyber ranges containing 156 internal hosts. Not puzzles with known-solvable flags. Environments shaped like the ones our customers actually run.

The best system solved 16.1 percent of the web exploitation tasks and 31.7 percent of the post-exploitation tasks. Then the researchers supplied concrete hints, which is to say they did the part a human expert does, and the same system jumped to 33.0 percent and 46.3 percent.

Point the agent at the right thing and it roughly doubles. What those researchers measured, without framing it this way, is the value of having someone behind the machine who knows where to look.

Where the Agents Actually Break

The most useful thing about the Fudan study is not the score. It is that the researchers diagnosed the failures instead of simply counting them, and the diagnosis is not what the marketing would lead you to expect. Their agents were not short of equipment. They ran on Codex and Claude Code with the full Kali toolkit and additional tools the authors selected from their own pentesting experience, and they had to discover credentials and work through live application flows the way an operator does.

What went wrong is attributed to reasoning. The agents “remain weak at information gathering and chained exploitation,” and the researchers are specific about why: “The primary cause is insufficient attack-surface exploration. They often stay on surface pages and common routes, missing deeper endpoints embedded in application-specific workflows.” Detection fell from 35 percent at depth two to 11 percent at depth six. The further into a real system they went, the worse they got.

The most damaging line in the paper is almost an aside. The agents “waste many reasoning steps on hosts that contain no exploitable weakness” because they “lack this prioritization ability.”

Prioritization is not a step in the work. It is the work. Organizations do not get breached because nobody found the vulnerability. They get breached because the one that mattered sat in a queue behind four hundred that did not.

Nobody Measures What the Machine Missed

The strongest counter-example makes the same point. Researchers from Stanford and Carnegie Mellon put six AI agents against ten professional penetration testers on a live network of roughly eight thousand hosts, and their best agent placed second overall, beating nine of the ten humans. That is a remarkable result and I have no interest in arguing with it. Read the failure modes, though. That agent produced more false positives than every human in the test, and it reached the critical unauthenticated console access on a set of Windows machines only after the researchers fed it mid-level hints.

It was not outmatched. It was undiscerning.

Which points at the thing none of this measures. Every benchmark in this argument, including the ones I have just quoted at you, reports what the agents found. Not one of them reports what the agents walked past.

A false positive costs an engineer an afternoon. A false negative is the breach, and it is invisible by construction. It does not show up in the report, or in the metrics. It shows up eighteen months later in somebody’s incident timeline.

That study could see the misses at all only because ten humans were working the same network alongside the machines. Left to itself, the agent would have filed a clean, credible report, and nobody reading it would have known what was not in it. Take the humans out of that experiment and you do not get a worse result. You get the same result with no way to know it was worse.

The same study contains the argument for a community rather than a model. Across ten professionals working one network, most of the vulnerabilities were found by only one or two participants. Not because the other eight were not trying. Because ten people with different backgrounds and different instincts take ten different paths through the same target, and the union of those paths is the coverage.

A model is one participant. You can run it a thousand times and it remains one participant, drawing on one distribution, reaching for what it has seen before. That is exactly why it stays on the surface pages and the common routes. It is not a defect in the engineering. It is what the thing is.

We did not spend a decade building a vetted community of researchers across more than a hundred countries because we could not afford software. We did it because adversaries are not a distribution either. They are specific people with specific ideas, and the only dependable way to anticipate an unusual idea is to employ a great many unusual people.

And That Is Exactly Where the Risk Is Moving

MITRE analyzed just over 39,000 CVE records for its 2025 CWE Top 25. Missing Authorization climbed five places to number four, the single biggest move on the list. Incorrect Authorization moved up one. Improper Access Control entered the Top 25 for the first time. Authorization Bypass Through User-Controlled Key, which is IDOR by its formal name, moved up six.

Every authorization weakness on MITRE’s list went up in a single year, and one of them was not on the list at all before.

OWASP tells the same story over a longer window. Broken Access Control held the number one position in both the 2021 and 2025 editions of the Top 10, and the CVEs mapped to it grew from 19,013 to 32,654, an increase of nearly 72 percent between editions. OWASP’s own summary of the 2025 data: “100% of the applications tested were found to have some form of broken access control.”

The machine is fastest on targets that hold still and blindest on the one class of flaw climbing every list that matters. You do not close that gap with more agents. It is not a throughput problem.

Even the Frontier Keeps a Human in the Loop

If autonomy were ready, you would expect the labs building it to be the first to run it unsupervised. Look at what the largest AI vulnerability discovery program on earth actually does.

Anthropic’s Mythos found more than 10,000 high or critical severity vulnerabilities across partner systems in a single month. Here is how those findings are handled before anyone hears about them: “we or one of the external security firms we work with reproduce the issue that Mythos has found and re-assess its severity.” For the open-source work they engaged six independent security research firms to do the assessing.

The organization with the most capable discovery engine in existence pays six security firms to check its homework.

And their own conclusion about where the constraint now sits is the argument I am making, in their words: “Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it’s limited by how quickly we can verify, disclose, and patch.”

The arithmetic underneath that is worth sitting with. Of 530 high or critical bugs reported to maintainers, 75 were patched. Maintainers asked them to slow the rate of disclosure, because they needed more time to design fixes. That is what happens when discovery outruns judgment, and it is happening at the one place on earth best equipped to keep up.

In June I made the aviation version of this argument in a piece called Nobody’s in the Cockpit. Modern aviation runs on autopilot because nobody expects a pilot to hand-fly every second of a transatlantic flight, and you do not then conclude the cockpit should be empty. Everything I have read since has sharpened that view rather than softened it. The most advanced autonomous bug hunter on earth ships with a pilot.

The labs are not the only ones saying this. In June, the co-founder of one of the autonomous pentesting startups published his own benchmarking of the newest models, and reached the same place:

“None of these models does a full-breadth pen test from a bare prompt and a URL. The harness supplies the machinery; the model supplies the judgment about what to probe next, when to dig deeper, and when to stop and report.”

He goes on to report that against Chromium and Firefox the best model identified bugs and exploitation primitives but did not autonomously produce a working full-chain exploit, and he recommends running it as a research assistant rather than an autonomous operator. I could not have put the case better, and I am not the one who has to sell the autonomy.

The Capability Is Arriving Ungated

Two days ago OpenAI announced that its newest system, Astra, meets the Critical cybersecurity threshold under its own preparedness framework. Their description of what that means: with the right tools and access, it “can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.”

That is the thing the autonomy pitch has been promising, and I am not going to pretend otherwise. It exists now.

So look at what its builders did with it. Astra is not a product. Access is limited to a small group of alpha testers, with broader defensive access to follow through a vetted program, and the model refuses 91.5 percent of cyber jailbreak attempts against 59 percent for their general-purpose release. Anthropic gates its own equivalent behind identity verification and a review process, and has said plainly that this capability class needs safeguards which it and, to its knowledge, every other developer have yet to build.

The organizations that built the most capable offensive AI on earth will not let most of their customers near it, and will not run it without someone watching.

The same capability is arriving somewhere else on very different terms. The UK’s AI Security Institute measured how far open-weight models trail the closed frontier on cyber tasks and put the gap at four to seven months, down from six to ten a year earlier. On narrow tasks, DeepSeek V4-Pro solved at 28 cents apiece where Opus 4.5 cost $12.50. Forty-five times cheaper, and the institute notes that its own setup probably understates what those models can do.

AISI is blunt about what open release means: “safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring.” Evaluating Kimi K3 jointly with its American counterpart, before that model’s weights went public, the two governments reported that its safeguards did not prevent it from attempting exploit development.

So here is the actual shape of the next two years. A defender who wants frontier offensive capability gets it gated, monitored, identity-verified, rate-limited and expensive, if they are approved for it at all. An adversary gets something four to seven months behind, for free, with the guardrails strippable, running on hardware nobody is watching, at a fraction of the cost.

The gap between what a defender can buy and what an adversary can run is not capability. It is permission.

Which is why the answer cannot be to buy the same autonomous tool and point it at yourself. Your adversary already has one, it cost them almost nothing, and nobody is rate-limiting it.

The Asymmetry Is Real, and It Is Not What People Think

I want to be careful here, because this is the point where our industry reaches for the apocalypse and loses the argument. So let me stay with what is documented.

AI has not made attackers smarter. The AI labs themselves keep saying so. OpenAI, reporting on the threat actor networks it has disrupted, found “no evidence that access to our models provided these actors with novel capabilities” and described the pattern as bolting AI onto old playbooks to move faster. Google’s threat intelligence group says it has “not yet observed” adversaries “achieving breakthrough capabilities that fundamentally alter the threat landscape.”

That is the honest read. It is also still a serious problem, because attackers never needed new capabilities. They needed cheaper attempts.

So here is the asymmetry, and it is arithmetic rather than fear. An attacker needs one path to work. A defender needs to know which of ten thousand findings is the one that matters. AI is extraordinarily good at generating attempts and quite poor at adjudicating truth. The cost of trying collapsed. The cost of knowing did not move.

You can watch it happen in the numbers. NIST, which runs the national vulnerability database, reported CVE submissions up 263 percent between 2020 and 2025. It enriched nearly 42,000 vulnerabilities last year, 45 percent more than any year in its history, and then said plainly: “this increased productivity is not enough to keep up with growing submissions.” So it stopped scoring everything and started triaging by risk.

Sit with that. The best-funded, most authoritative vulnerability adjudicator on earth publicly conceded it cannot keep pace, and its answer was not more throughput. It was prioritization, which is another word for judgment.

The UK’s National Cyber Security Centre says where that leads, in its own careful language. There will “almost certainly be a digital divide between systems keeping pace with AI-enabled threats and a large proportion that are more vulnerable.” The window is also closing. The time between disclosure and exploitation “has shrunk to days and AI will almost certainly reduce this further.”

That divide is the moment we built this company for.

The Constraint Was Never the AI

This is where I part company with my own side of the argument, because the people defending traditional manual pentesting are wrong too.

Annual, point-in-time penetration testing is indefensible now. Testing an environment once a year, against adversaries iterating continuously and at almost no cost, is not a security program. It is a compliance artifact. We never settled for that cadence because anyone believed it was sufficient. We settled for it because expert hours are scarce, so organizations scoped testing to the talent they could get and everything else went untested by default.

That constraint is now tightening. ISC2’s 2025 workforce study, drawn from more than 16,000 practitioners, found teams reporting critical or significant skills gaps rose from 44 percent to 59 percent in a single year, and 88 percent traced at least one security incident or operational failure directly to a skills shortage. Meanwhile raw headcount pressure eased slightly. The bodies problem is improving. The judgment problem is accelerating.

That is the shift worth understanding. When every tool on the market can generate findings at machine speed, the scarce resource stops being findings and becomes the ability to know which ones matter.

AI does not remove that constraint. It makes it decisive, and it makes every expert who has that judgment dramatically more valuable, because it strips away the repetitive work that used to consume most of their day and points them at the part only they can do.

That is the bet. Not AI instead of experts. AI underneath the best experts in the world, so their judgment reaches further than it ever could alone.

What We Just Built

Today NetSPI and Synack announced a definitive agreement to merge, backed by KKR, forming the industry’s leading offensive cybersecurity platform.

The combined company is approaching $300 million in revenue and serves top cloud providers, top U.S. banks, the MAMAA companies, the Fortune 100 and U.S. federal agencies. Together we bring nearly 40 years of operating history and more than 13 million hours of premier, real-world offensive security testing.

That last number is the one I care about. Thirteen million hours is not a marketing figure. It is an accumulated understanding of how systems actually fail, how attackers actually adapt and where conventional testing consistently stops one step too early. You cannot raise a round and buy it, and you cannot synthesize it, because most of it was never written down anywhere a model could train on.

NetSPI pioneered Penetration Testing as a Service and built one of the deepest deep-dive testing practices in the industry. Synack built the Synack Red Team, a rigorously vetted global community of researchers, and a platform that pairs their judgment with Sara AI Pentesting. Put the deepest testing in the industry on the most trusted platform in the industry and you do not get one plus one. You get a category that did not exist yesterday.

We intend to push AI as hard as anyone in this market, and probably harder. What we will not do is confuse the machine for the judgment.

What This Changes Right Now

For customers: nothing today. Your team, your testing cadence and your platform stay exactly as they are. The transaction is expected to close in October 2026, subject to customary closing conditions and regulatory approvals, and until then NetSPI and Synack continue to operate as separate companies. What grows is what we can eventually put behind you: more expert capacity, broader coverage and faster answers as your attack surface expands.

For the Synack Red Team: this is the strongest possible statement of your value. If I believed autonomous technology could replace expert judgment, then merging two of the largest concentrations of expert judgment in the industry would be a spectacular waste of capital. The SRT’s community, model and standards are not being replaced. They are the reason this deal makes sense.

Autonomy Was Never the Goal

The autonomous claims will keep coming. Some of the technology behind them will be genuinely impressive, and a fair amount of it will end up inside our platform, because we are buyers of anything that makes our experts faster.

But autonomy was never the goal. The goal is finding the vulnerabilities that put organizations at real risk and giving customers answers they can trust, and every piece of evidence in front of us says that takes AI and expert humans operating together.

The industry is spending an enormous amount of money to prove otherwise. We just spent a merger betting it will not.

There is a hard few years coming for anyone on the wrong side of that digital divide. We did not build this company to warn people about it. We built it to be standing there when they need someone who can tell them which of the ten thousand findings is the one that matters.

Day one starts now.

Talk with our team or see Sara AI Pentesting in action.