AI-Powered Pentesting Can't See Everything — Here's What It Misses
Agentic, AI-driven penetration testing has made automated attack-path discovery faster and cheaper, but security vendor Picus Security argues it leaves real gaps. According to Omdia research cited in the analysis, organizations test only 32% of their attack surface on average — and agentic pentesting, by design, can only probe what it can safely reach.
Where Agentic Pentesting Falls Short
Unreachable Assets
Agentic pentesting tools are built with safety guardrails that prevent them from testing critical production systems outright, and network segmentation keeps air-gapped or isolated zones out of reach entirely. Picus cites a real customer case where only 120 of 480 affected nginx instances could actually be tested by an autonomous agent — the rest were simply inaccessible to the tooling.
Missing Exploits
Automated exploitation depends on having exploit code or proof-of-concept detail to work from. Picus notes that only about a quarter of 2025 CVEs had public PoC code or exploit details available — meaning the majority of vulnerabilities in any environment can't be automatically exploited by an agent even when the asset itself is reachable.
The Three-Method Approach Picus Recommends
| Method | What It Covers |
|---|---|
| Autonomous Pentesting | Creative, agent-driven testing against assets the tooling can safely reach |
| Exposure Validation | Analyzes the attacker behaviors a given CVE would require against live security controls — covering assets agents can't directly touch |
| Breach and Attack Simulation (BAS) | Tests whether defensive controls actually stop the behaviors associated with a given exploit |
Run together through a unified platform, Picus argues this combination lets teams "validate every CVE on every asset in hours" rather than the weeks a fully manual approach would take — without the blind spots an agentic-only approach leaves behind.
Why It Matters
The pitch for agentic pentesting has largely been speed and cost — replacing or augmenting expensive manual red-team hours with autonomous agents that can chain attack paths on their own. This analysis is a useful corrective: speed on the reachable 32% of an attack surface doesn't tell you anything about the other 68%, and a vulnerability with no public PoC doesn't disappear just because an automated tool can't exploit it. Validation coverage, not just testing speed, is the metric that should drive buying decisions here.
Recommendations
- Don't treat agentic pentest coverage as full attack-surface coverage — ask any vendor what percentage of your environment their tooling can actually reach versus merely enumerate.
- Pair autonomous testing with exposure validation for production and segmented assets that safety guardrails keep agents away from.
- Track CVEs without public PoC code separately in your vulnerability management program — breach and attack simulation can validate exposure to these even without an automated exploit.
- Prioritize patching based on validated exploitability, not just CVSS score, when choosing between the roughly three-quarters of CVEs lacking PoC code and the smaller set that's readily weaponizable.
Key Takeaways
- Agentic pentesting tools test only the portion of an environment they can safely and technically reach — on average, 32% of the attack surface per Omdia research.
- Safety restrictions and network segmentation keep critical production systems and air-gapped zones out of automated reach; in one case, only 120 of 480 affected instances were testable.
- Roughly three-quarters of 2025 CVEs lacked public PoC code, limiting what any automated exploitation approach can cover.
- Picus recommends combining autonomous pentesting, exposure validation, and breach and attack simulation to close the gap left by agentic-only testing.