The 2026 State of Agentic AI in Pentesting
95% of surveyed organizations rank pentesting a top or high priority. On average they test just 32% of their attack surface. Omdia surveyed 200 security leaders, on behalf of Synack, about what they are doing with the other 68%.
What 200 security leaders told Omdia
A 68% coverage gap
95% rank pentesting a top or high priority, yet the average organization tests only 32% of its attack surface. For roughly a third, 20% or less of their infrastructure gets regular assessment.
Adoption is past evaluation
87% have moved beyond evaluating agentic AI for pentesting and are planning a pilot, testing, or already running it in their programs. One in four respondents expect their organization to pentest exclusively through agentic AI within three years.
Oversight is the preference
64% prefer agent-led testing with human oversight, against 22% for fully autonomous operation. 93% say comprehensive guardrails are important or critical to safe operation.
The pentesting coverage gap
Security leaders named four reasons manual testing does not scale: it depends on human talent that is hard to grow against fast development cycles, it is resource intensive enough to be rationed into periodic snapshots, it struggles to communicate findings to stakeholders (55% say so), and findings often arrive without the context needed to judge real exposure.
None of those is a question of intent. They describe the limits of a testing model built around scheduled, human-only engagements, applied to an attack surface that changes continuously.
What deployed adopters report, and the accuracy bar
Among organizations that have already deployed agentic AI for pentesting, 87% agree it has enabled them to test a higher percentage of their global attack surface and 91% agree it has allowed them to test more regularly. 60% say testing their attack surface is significantly or somewhat easier than it was twelve months ago, a rate 1.3 times higher than organizations still piloting. These figures describe that subset of 83 organizations rather than the full sample of 200.
Security leaders set a precise condition before agentic AI counts as effective: 69% require at least 85% accuracy compared with manual testing. That figure measures what buyers expect, not what any product has been shown to deliver. Trust is already high, with 87% reporting high or complete trust in agentic AI to test their enterprise environments, and transparency is what builds it. 58% cite transparent AI decision-making as the top factor, ahead of certifications and standards compliance at 54%.
Coverage, not cost, is what drives adoption. More comprehensive coverage leads at 21%, ahead of consistency and repeatability, testing frequency and faster results. Cost reduction ranks near the bottom at 9%.
The report also marks a known limit. Vertical chaining, escalating privileges within a single system, is becoming common in agentic testing. Horizontal chaining, pivoting across systems and accounts to widen an attack, is what an advanced pentester does and what the report says most AI solutions cannot yet match. It notes too that purely autonomous approaches can carry considerably higher false positive rates. That observation is Omdia commentary rather than a survey measure.
What human expertise adds
64% of respondents prefer agent-led testing with human oversight, against 22% for fully autonomous operation and 14% for human-led testing with agent assistance. Organizations already using agentic AI are 1.6 times more likely to view human oversight as a permanent requirement than those still piloting. Supervision is only part of what experts contribute.
Sara AI Pentesting
Machine speed and scale. Agentic AI discovers, triages, prioritizes and analyzes vulnerabilities across the attack surface, so more of the environment is tested more often.
Synack Red Team
Business context, creative testing and validation. More than 1,500 vetted security researchers design attacks an agent has not seen, confirm what is genuinely exploitable, and pursue the horizontal chains across systems and accounts that automation alone misses.
Research methodology
A primary research study commissioned by Synack and conducted by Omdia, fielded as a quantitative web-based survey of 200 qualified completes in the United States between December 11 and 22, 2025.
Respondents were security leaders at manager level or above, plus security practitioners, all of whom hold responsibility for their organization's investments in AI tools for cybersecurity, at enterprises with 1,000 or more employees. Sample sizes vary by question and are shown alongside the relevant findings. Figures describing deployed adopters reflect a subset of 83 organizations.
Related Synack research is on the State of Continuous Security Validation page, and the capability this research points to is covered on the AI pentesting page.
Questions about the research
What is the 68% security coverage gap?+
Organizations pentest an average of 32% of their attack surface, leaving 68% untested. Roughly one third of organizations assess 20% or less of their infrastructure regularly, even though 95% rank pentesting a top or high priority.
How far along is agentic AI adoption for pentesting?+
87% of organizations have moved beyond the evaluation phase and are planning a pilot, testing, or have already integrated agentic AI into their pentesting programs. One in four respondents expect their organization to pentest exclusively through agentic AI within three years.
What accuracy do security leaders require from agentic AI?+
69% require at least 85% accuracy compared with manual testing before they would consider agentic AI effective. That measures what buyers expect, not demonstrated performance. 87% report high or complete trust in agentic AI to test their enterprise environments, and 93% say comprehensive guardrails are important or critical to safe operation.
Do organizations want fully autonomous pentesting?+
Most do not. 64% prefer agent-led testing with human oversight, 22% favor fully autonomous operation and 14% prefer human-led testing with agent assistance. Organizations already using agentic AI are 1.6 times more likely to view human oversight as a permanent requirement than those still piloting.
Why are organizations adopting agentic AI for pentesting?+
More comprehensive coverage is the leading driver at 21%, followed by consistency and repeatability at 19%, increased testing frequency at 18% and faster time to results at 17%. Cost reduction ranks lower at 9%.
Who conducted the research?+
Omdia conducted the study, commissioned by Synack. It surveyed 200 US security leaders at enterprises with 1,000 or more employees between December 11 and 22, 2025.
Get the 2026 State of Agentic AI in Pentesting
Twenty pages on adoption, trust, accuracy expectations, asset priorities, guardrails and the barriers still holding organizations back. No form, no email required.