The Blind Spots of Agentic Pentesting and How to Close Them

By Sila Ozeren Hacioglu, Security Research Engineer at Picus Security.

For years, security teams had a window of several weeks between a CVE going public and attackers exploiting it. Every year, that window got smaller. Then Mythos-class models arrived, and attackers can now weaponize a new CVE within hours. That leaves security teams very little time to find out whether they’re exposed.

That’s where offensive testing comes in. But it has traditionally run on a schedule. Over the years, that schedule got tighter. Annual pentests became quarterly, and automated penetration testing tools made weekly testing possible.

Each advancement shortened the time a change could go untested. Traditional automated pentesting worked fine back when exploitation took weeks. Now that attackers have made a big jump, offensive testing is making one too.

That jump is agentic pentesting. It’s the sharp edge of offensive testing today, but it has blind spots. This piece looks at where they are and how to close them.

How Agentic Pentesting Should Work

A manual pentest usually goes through several phases: reconnaissance, vulnerability assessment, initial access, post-exploitation, and reporting. Traditional automated pentesting tools follow the same phases. Even before LLMs took off, some advanced tools used machine learning to choose the next step. For example, five years ago, we built our Attack Path Validation (APV) product with such a decision engine. But AI agents take it further.

In agentic pentesting, one or more AI agents carry out a pentest step by step. In our agentic pentesting product, Picus Swarm uses five specialist agents orchestrated by Numi AI.

AI pentest agents evaluate findings and your organization’s context to choose the next step dynamically. That creativity lets them find exploit chains much faster than a human pentester, including some a human might miss entirely. However, creativity comes at a cost.

Running everything agentically uses a lot of tokens, and results vary from run to run. Even when nothing has changed in the environment, an agent can fail to exploit a vulnerability five times and succeed on the sixth. Running dozens of tests to be sure gets expensive, and in a large organization with thousands of endpoints, a single agentic run can take weeks.

That’s why deterministic automated pentesting is still needed. It’s less creative, but it delivers consistent testing, costs less, and finishes faster, so it can run far more often. It follows repeatable steps, allowing teams to compare runs over time and reliably retest fixes.

The right approach offers both. Run deterministic tests often for predictable coverage and agentic tests at set intervals. How often depends on your organization’s needs and risk appetite. Picus Autonomous Pentesting can run in either mode, fully agentic or deterministic, and adapts to your context, risks, and changes in the threat landscape and your environment.

Agentic pentesting is valuable, and the need for it is real. But it has limits worth understanding.

See What Your Pentesting Covers, and What It Doesn’t

In most deployments, automated pentesting covers only one of six surfaces you need to validate.

This whitepaper shows what stays untested, from detection rules to cloud, identity, and AI guardrails, why adding AI doesn’t lift that ceiling, and three questions that expose the gap.

Read the Guide

The Achilles’ Heel of Agentic Pentesting: Untestable Assets and Exposures

Agentic pentesting’s biggest strength is also its limit. It tests by running real attacks, so it can only test what it can safely reach. Omdia research found that organizations pentest only 32% of their attack surface on average.

Safety restrictions keep it off critical systems. A real exploit can crash a service, corrupt data, or trigger a failover. That’s why PCI and NIST guidance advises testers to avoid potentially disruptive exploits on fragile production systems. Reachability limits the rest. The agent can only test what it has a network path into, so segmented and air-gapped zones stay out of reach.

We saw this in one customer environment. Their scanners flagged an nginx-ui authentication bypass (CVE-2026-33032) on 480 instances.

Within the permitted scope, agentic pentesting could test only 120 of them. It confirmed that 80 were exploitable, while 40 were blocked. The other 360, three out of every four affected instances, were out of reach and received no verdict.

The nginx-ui case covered a single CVE. Zoom out to all the CVEs in your environment, and a second gap appears. Even on assets an agentic pentesting tool can reach, many vulnerabilities can’t be tested because there’s no exploit to run.

VulnCheck found that only about a quarter of 2025 CVEs had proof-of-concept (PoC) code or exploit details. It also found that 29% of the vulnerabilities it confirmed as exploited in 2025 were exploited on or before their CVE publication dates. With no public exploit to run, some teams ask an LLM to write one. However, an untested exploit might crash a service or corrupt data.

So agentic pentesting leaves two gaps: the assets it never reaches, like those 360 instances, and the vulnerabilities it can’t test on the assets it does reach, often because there’s no exploit to run.

Want the full technical breakdown? Download the whitepaper.

How Exploitability Validation Covers All Your Assets and Exposures

In the nginx-ui bypass case discussed above, agentic pentesting left 360 of the 480 affected instances without an answer. Exploitability validation, delivered by Picus Exposure Validation, doesn’t try to reach them with an exploit. It breaks the CVE down into the attacker behaviors required to exploit it and tests each behavior against your live security controls within hours.

Because the verdict rests on control evidence rather than successful exploitation, a missing PoC is not treated as proof that an asset is safe. This addresses both gaps. Combined with asset context, that evidence gives the 360 untested instances a verdict: 260 blocked by controls and 100 likely exploitable.

The 480 raw findings become 180 evidence-backed priorities: 80 confirmed exploitable through agentic pentesting and 100 assessed as likely exploitable through Exposure Validation.

You know which hosts your controls already cover and which need a compensating control today.

Three Methods Working Together to Validate Every CVE and Every Asset in Hours

Running these methods as separate tools can produce siloed or duplicated findings and conflicting priorities. They need to feed one shared, evidence-backed, context-aware findings model, with one backlog and one result per exposure.

The Picus Platform is built on that principle, with Autonomous Pentesting, Exposure Validation, and Breach and Attack Simulation working from shared evidence.

When a critical CVE drops, Numi AI picks it up as a signal, and Picus Swarm's agents take it from there.

• Discovery. The CVE is enriched with threat intelligence and mapped to attacker techniques. Affected assets, their business criticality, and deployed controls are identified.
• Validation. Autonomous Pentesting tests in-scope assets, Breach and Attack Simulation tests controls, and Exposure Validation assesses every affected asset.
• Mobilization. Low-risk mitigations are deployed automatically. The rest are assigned to owners, and every fix is revalidated.

The whole cycle runs in hours, not weeks.

The Bottom Line

Attackers with Mythos-class models can now weaponize a new CVE within hours. Agentic pentesting is the most powerful way to test like a real attacker, and when the same platform also supports deterministic tests, testing stays both creative and repeatable. But even together, these methods can only test what they can safely reach.

Exposure Validation covers the rest. Together with Breach and Attack Simulation, the three capabilities work as one platform to validate every CVE on every asset in hours.

Want to see it live? We’ll walk you through it. Request your free demo now. 

Sponsored and written by Picus Security.