Annual pentest seen as obsolete by 90% of leaders

Intruder has published research suggesting the annual penetration test is now seen as obsolete by 90% of security and engineering leaders. The survey points to growing use of AI-based testing as software release cycles accelerate.

Based on responses from 500 security and engineering decision-makers in the US and UK, the study found that 68% of organisations deploy code at least daily and 37% do so multiple times a day. Yet 47% go more than a month between full penetration tests on web applications and APIs, while only 1% test on every major release.

That gap appears to leave many teams exposed. Only 4% of respondents said their current testing frequency gives them sufficient coverage, while 42% said they accept the risk and ship code without additional security checks between pentests.

Among organisations that run scheduled pentests, 88% said they worry about unmapped risk introduced between tests. The findings suggest that while leaders recognise the weakness of periodic testing, many still lack the resources or processes to assess code continuously as development teams push updates into production.

Manual work also remains a burden. More than half of respondents, 56%, said security teams spend six hours or more each week triaging, validating or dismissing false positives and non-exploitable findings. A further 21% said they spend 11 hours or more, longer than a full working day.

Even after fixes are released, verification often lags. Fewer than two in five organisations independently retest a fix in production as soon as it ships, and nearly half take up to two weeks to do so.

AI uptake

The report found broad adoption of AI pentesting tools. Some 92% of organisations said they had tried or adopted AI pentesting, and 55% said they already use it across their environment.

Respondents appeared less concerned about whether AI testing can match human testers than about how these tools operate in sensitive settings. Just 25% cited the depth of AI testing compared with human testers as a leading barrier. By contrast, 40% pointed to data privacy, 36% cited safety on production systems and 28% questioned whether auditors and regulators would accept AI-generated reports.

Trust in automated testing also depends on visibility. Nearly half of respondents, 46%, said the biggest factor likely to damage their trust in AI pentesting would be a lack of visibility into what was tested or a lack of reproducible proof of exploitability.

Chris Wallis, Chief Executive Officer and Founder of Intruder, said shifts in development and attack patterns had changed the economics of security testing. "AI has permanently altered both the volume of code going into production and the speed at which attackers can exploit flaws," he said.

"To close the exposure gap, security validation must become as continuous and automated as the pipelines building the code. The annual pentest may be dead, but the need for continuous validation has never been more real."

Midmarket pressure

The research also highlighted pressure on companies with 1,000 to 4,999 employees. These organisations tend to deploy code as frequently as the largest companies but often operate with smaller security teams.

In that group, 47% were the least likely to pentest at least monthly, and half said they accept the risk and ship code without further checks between tests. Although midmarket organisations had tried AI pentesting at the same rate as the largest businesses, they were less likely to have rolled it out across their environment, with 54% doing so compared with 71% of companies with 5,000 to 10,000 employees.

Only 4% of midmarket respondents said they faced no major barriers to adopting AI pentesting. Intruder linked this to broader strain on security teams, citing earlier research in which 42% of midmarket teams described themselves as stretched, overwhelmed or consistently behind.

Definitions vary

The survey also suggested the industry lacks a shared understanding of what continuous pentesting means. While 96% of organisations said continuous pentesting is a priority and more than a third said they had achieved it, no single definition of the term was selected by more than 35% of respondents.

Geography and sector also shaped adoption patterns. US organisations were ahead of their UK counterparts, with 64% using AI pentesting across their environment compared with 42% in the UK. By sector, professional services and financial services led adoption at 64% and 63% respectively, while manufacturing lagged at 39%.

Financial services also stood out for release speed, with 46% of respondents in the sector saying they deploy code multiple times a day. The data underlines how often security teams are now being asked to validate software in production environments that change far more frequently than traditional annual or periodic testing models were designed to handle.