Quick answer: "Automated penetration testing platform" describes four different products, and only one of them tries to do what a penetration test does. Vulnerability scanners find known-class issues. Breach and attack simulation tests whether your controls catch known techniques. Exposure validation ranks what is reachable. Autonomous exploitation agents chain and exploit, and the published evidence says they are genuinely competitive and still incomplete: on a live 8,000-host network the best agent placed second against ten working professionals at an 82% valid submission rate, while 80% of those professionals found a critical remote code execution bug the agent reached only with hints (arXiv 2512.09882). Four of the eleven platforms below publish a price. Stingrai ranks first at US$3,000 one-time or US$650 per month for an Autonomous Pentest of one web application and its APIs, with a published No High or Critical Finding = Don't Pay guarantee, because the platform sits inside a CREST-accredited penetration testing firm that can escalate any scope to its penetration testers rather than stopping where the automation stops.
Every platform fact on this page was read from that vendor's own website on 11 September 2026 and links back to it. Every benchmark figure traces to a named primary publisher. Where a vendor publishes no price, this page says "not published" rather than substituting a third-party estimate.
What "automated" actually means, in four categories
The word does a lot of work in this market, and the four things it covers are not substitutes for each other. Sort a shortlist by category first, because two products in different categories cannot be compared on price.
Category | What it does | What it produces | What it does not do | Example platforms |
|---|---|---|---|---|
Vulnerability scanning and DAST | Signature and heuristic detection of known-class issues across an asset list | A findings list with CVE references and severity scores | Chain weaknesses, reason about who should be allowed to do what, or prove exploitability | Pentest-Tools.com at its scanning tiers |
Breach and attack simulation | Replays known adversary techniques against your environment to see what your controls block and detect | A control-efficacy report mapped to techniques | Find unknown vulnerabilities in your application; it tests defences, not code | |
Exposure and adversarial validation | Prioritises which known exposures are actually reachable and worth fixing first | A ranked exposure list with reachability evidence | Produce a penetration test report; it validates exposures rather than exploiting a scope end to end | |
Autonomous exploitation agents | Discovers, chains and safely exploits, then reports the attack path with proof | Findings with a reproduction path and proof of exploitation | Reliably reach the flaws that require a model of the business, and still misses things people catch | Stingrai Snipe, Horizon3.ai NodeZero, Cobalt Autonomous Pentest, Intruder, Astra Pentest Auto, RidgeBot |
A longer decoder for the acronyms, including where CTEM sits, is in AEV vs BAS vs PTaaS vs autonomous pentest.
The single question that separates a scanner from an exploitation agent is whether the product produces proof. A scanner asserts that a version string matches a vulnerable range. An exploitation agent shows the request, the response, and the state it reached. Ridge Security publishes this distinction directly, stating that RidgeBot uses "real proof-of-concept code to exploit vulnerabilities" (Ridge Security). Horizon3.ai publishes that NodeZero "pivots through your network, chaining together weaknesses just as an attacker would and then safely exploits them", providing "proof of the exploit, its impact on your organization, and mitigation recommendations" (Horizon3.ai).
The evidence: what autonomy actually finds
This category spent years running on vendor anecdote. It no longer has to.
The largest public head to head. In December 2025, researchers ran ten working cybersecurity professionals against six existing AI agents plus a new multi-agent framework, ARTEMIS, on a live network of roughly 8,000 hosts across 12 subnets. ARTEMIS placed second overall and outperformed 9 of the 10 human participants, finding 9 valid vulnerabilities at an 82% valid submission rate, and the abstract records that "certain ARTEMIS variants cost $18/hour versus $60/hour for professional penetration testers" (arXiv 2512.09882). Anyone still calling autonomous tooling a toy is arguing against measurement.
Exploitation of real CVEs. On CVE-Bench, the best agent exploited 13% of critical web CVEs in a zero-day setting and 25% in a one-day setting, where the vulnerability description is supplied (arXiv 2503.17332). That is a genuine capability and a long way from complete coverage.
Volume and speed. The structural advantages the research names are systematic enumeration and parallel exploitation. An agent does not get bored on host 4,000 of 8,000, does not skip the tedious permutation, and runs at a cost per hour the same paper puts at roughly a third of a professional's.
A fuller roundup of the public benchmarks, including what each one measures and where the measurement breaks, sits in AI pentest benchmark results 2026.
The evidence: what autonomy misses
The same studies are unusually specific about the ceiling, which is what makes them useful for a buying decision.
The qualitative gap is real and it is where the severity lives. In the live-network study, 80% of the human participants found a critical remote code execution bug that the best-scoring agent reported only under guided elicitation with hints. The paper also records higher false-positive rates for agents and difficulty with GUI-driven exploitation.
Assistance roughly triples the result. On AutoPenBench, a 33-task benchmark of vulnerable systems of increasing difficulty, a fully autonomous agent reached a 21% success rate, solving 27% of simple tasks and one real-world scenario, while the same agent with human assistance reached 64%. That ratio is the most honest single number in this category, and it has not moved much.
The largest vulnerability class has no signature. OWASP publishes for A01:2025 Broken Access Control that "100% of the applications tested were found to have some form of broken access control", across 40 mapped CWEs and 32,654 CVEs (OWASP Top 10:2025). An IDOR is a correctly formed request with the wrong identifier in it. Nothing about it looks anomalous to a detector that matches patterns, which is why the products worth paying for in this category are the ones explicitly built to reason about authorisation rather than to enumerate versions.
False positives are a scope problem, not a tuning problem. A platform that proves exploitation has a structurally lower false-positive rate, because a finding that cannot be exploited never gets written. A platform that reports on evidence of a condition will always carry noise. The realistic target rates, and how to hold a vendor to them, are set out in what counts as an acceptable false-positive rate.
The category finally has a governance standard
Until recently there was no published way to ask a vendor whether its agent will stay inside scope. There is now.
The OWASP Autonomous Penetration Testing Standard (APTS) v0.1.0 defines 173 tier-required requirements across 8 domains: Scope Enforcement (26), Safety Controls (20), Human Oversight (19), Graduated Autonomy (28), Auditability (20), Manipulation Resistance (23), Supply Chain Trust (22) and Reporting (15). It sets three conformance tiers, Tier 1 Foundation at 72 requirements, Tier 2 Verified at 157 cumulative and Tier 3 Comprehensive at all 173, and four autonomy levels from L1 Assisted through L4 Autonomous. It describes itself as a governance standard rather than a testing methodology, complementing PTES and the OWASP WSTG (OWASP APTS).
Two things about that structure are worth carrying into a vendor call. First, 46 of the 173 requirements are about scope enforcement and safety, which tells you what the standard's authors thought the actual risk of this technology was. Second, a vendor that cannot tell you which autonomy level its product operates at, or which tier it targets, is not being evasive about a technicality: it is telling you that nobody has written the answer down.
What auditors accept, and what they do not
This is where a large number of automated-platform purchases go wrong. The platform is genuinely good, the finding quality is genuinely high, and it still does not discharge the obligation that paid for it.
Framework | What the requirement says | Does an automated platform's output satisfy it? | Source |
|---|---|---|---|
PCI DSS v4.0.1 | 11.4.1 requires a documented methodology based on an industry-accepted approach with application-layer coverage of the Requirement 6.2.4 classes. 11.4.2 and 11.4.3 require internal and external testing at least every 12 months and after significant change, by a qualified resource with organisational independence. 11.4.4 requires exploitable findings corrected and testing repeated to verify. | Not on its own. Quarterly ASV scanning sits at 11.3.2 and does not satisfy 11.4, and the methodology, qualification and independence conditions attach to the tester rather than the tool. | |
CMMC Level 3 | Testing at least annually or on significant security change, with records reviewed by the DIBCAC assessment team | No. Level 3 requires both automated tools and ad hoc tests by subject matter experts. | |
FedRAMP | Mandatory, covering six specific attack vectors, with the report attached to the SAR and repeated annually in continuous monitoring | No. The report must come from a 3PAO. | |
SOC 2 | Not mandated by name. A test report is accepted as evidence for a control the organisation wrote itself. | Often yes, if the control description matches what the platform actually did. | |
ISO 27001 | Not mandated by name. Testing evidences controls A.8.8, A.8.29, A.8.25, A.5.35 and A.5.36. | Often yes, with the policy, scope, rules of engagement, findings register and retest record around it. | |
HIPAA | Not mandated currently. Scope is set by the entity's own risk analysis. | Depends entirely on what the risk analysis says. |
The pattern is consistent. Where a framework merely wants evidence that testing happened, an automated platform's report usually works. Where a framework names a qualified, independent human tester or a specific accreditation, the platform produces input to the engagement and not the engagement itself. That distinction is the single most expensive thing to discover late, and it is the reason the ranking below weights whether the same provider can escalate to accredited human-led testing without a change of vendor.
Automated penetration testing platforms, ranked
Eleven platforms, ranked on four criteria that can be checked against a published page rather than a sales deck:
Proof per finding. Does the vendor publish that its product demonstrates exploitation rather than asserting a condition?
Documented scope and safety controls. Is there a published statement about what the product will and will not touch?
Price transparency. Is there a figure on the vendor's own site?
Escalation path. Can the same provider take a scope the automation cannot finish and put accredited penetration testers on it?
1. Stingrai
What it is. Stingrai is a CREST-accredited offensive security company. Its penetration testers simulate real-world attacks across applications, cloud, networks, and people, with testing delivered through its PTaaS platform. Founded in 2021, headquartered in Toronto, Canada with an office in London, UK, it delivers both one-time penetration tests and continuous testing programmes.
The automated tier, stated plainly. Snipe is Stingrai's AI agent for web application penetration testing, including the application's APIs. It is available for autonomous web testing, or alongside penetration testers in a Hybrid web engagement. Snipe and the Hybrid tier are the web application package only. Mobile, cloud, network, social engineering and red team engagements are fully human-led, scoped and delivered by Stingrai's penetration testers, who hold OSCE3, OSCP, OSWE, CREST CRT and CISSP certifications.
Why it ranks first. Every other entry on this list is a product. This one is a product inside an accredited penetration testing firm. When the web application scope is what you need automated, the Autonomous tier does it at a published price with same-day results. When the scope grows past one web application, or an auditor names a qualified independent tester, the escalation path is a phone call rather than a procurement cycle. That is what regulated buyers in financial services, healthcare and SaaS under SOC 2, ISO 27001, PCI DSS and HIPAA are actually purchasing.
Published price. US$3,000 one-time for an Autonomous Pentest and US$6,800 one-time for a Hybrid Pentest, each covering one web application and its APIs, or US$650 and US$1,275 per month on a 12-month continuous engagement. Retesting is included, and the Autonomous tier carries a published No High or Critical Finding = Don't Pay guarantee. Everything else is quoted through Get a Quote. Figures on the pricing page.
On output rather than claims. Stingrai's State of Penetration Testing 2026 analysed 1,206 verified findings from 55 penetration tests. 92.7% of those tests surfaced at least one High or Critical finding, the dataset carried a 0.74% false-positive rate, and the median Critical finding took 10.5 days to fix. Stingrai's penetration testing supports SOC 2, ISO 27001, PCI DSS and HIPAA programmes by producing the scope statement, technical report, remediation record and retest evidence those programmes consume.
2. Horizon3.ai NodeZero
Autonomous exploitation across the network rather than the application. Horizon3.ai publishes that NodeZero runs Autonomous Pentesting without agents ("No agents."), chains weaknesses and safely exploits them, and returns proof of the exploit with impact and mitigation guidance. Named scopes include Internal, External, Cloud, Kubernetes, Active Directory password audit and phishing impact testing, and the platform advertises a first pentest set up "in minutes". Price: not published. The packaging page carries no currency figure. horizon3.ai.
3. Cobalt Autonomous Pentest
An autonomous product inside a platform that also sells human-delivered tests, which gives it an escalation path most tools lack. Cobalt publishes free retesting on all tiers and defines a Cobalt Credit as "the equivalent of 8 hours of offensive security testing". Price: US$3,500 per test, on a promotional rate whose fine print states that an Autonomous Pentest "must be initiated and completed before Dec 31st 2026 in order to qualify". The Standard, Premium and Enterprise credit tiers are quote-only, so the standing rate after that date is not published. cobalt.io/platform/pricing.
4. Intruder
Intruder publishes a same-day, white-box web application pentest with no lead times or scoping, repository integration for GitHub, GitLab and Bitbucket Cloud, unlimited retesting, and same-day reports usable as ISO 27001 and SOC 2 evidence. The commercially interesting part is the published guarantee: if an auditor rejects the report, Intruder refunds the test in full. Price: US$3,500 per test, or US$12,000 for a four-test pack, which must be used within one year of purchase. intruder.io/pentest-pricing.
5. Astra Security
Astra's pricing page describes Pentest Auto as a "hacker style autonomous pentest at machine speed", sold per target, where one web or SaaS app counts as one target including all APIs consumed and mobile is counted per platform. Above it sit Pentest Expert and Enterprise, which add human testing. Re-scan entitlements are published: one human re-scan on Pentest Auto, two on Pentest Expert. Price: US$2,999 a year (Pentest Auto), US$5,999 a year (Pentest Expert), from US$9,999 a year (Enterprise), per target. getastra.com/pricing.
6. BreachLock
BreachLock publishes PTaaS, Continuous Penetration Testing, Attack Surface Management, Red Team as a Service and an Adversarial Exposure Validation product. Its published position on automation is unusually explicit: the autonomous engine handles host discovery, port scanning, service and protocol enumeration and initial vulnerability scanning and exploitation, and every finding it surfaces is then manually validated by a certified penetration tester. Retest entitlements are published per package: one free manual re-test on Standard, two on Extended, custom on Extensive. Price: not published. All three packages are quote-only. breachlock.com.
7. RidgeBot, from Ridge Security
RidgeBot autonomously scans, validates and safely exploits, and Ridge Security publishes that it uses real proof-of-concept code to do so. Named coverage spans external and internal network attacks, lateral movement, API testing against the OWASP Top 10, website testing, Windows Active Directory and ransomware threat assessment, with third-party vulnerability validation alongside. Available through the Azure and AWS marketplaces. Price: not published. ridgesecurity.ai.
8. Picus Security
A security validation platform rather than a penetration testing product, and it is clear about that. Picus publishes breach and attack simulation as its primary offering, continuously testing what EDR, SIEM, firewall and WAF controls actually block and detect, alongside an autonomous penetration testing capability that executes real exploit chains and an exposure validation capability that "proves exploitability without firing an exploit" for assets no live test can touch. Buy it to measure defences, not to produce an application penetration test report. Price: not published. picussecurity.com.
9. AttackIQ
Three named products: AttackIQ Flex for on-demand exposure validation, AttackIQ Ready! for fully managed continuous validation, and AttackIQ Enterprise for in-house control of security readiness, with an agentic layer and a command centre around them. Same category as Picus and the same buying advice: this measures whether your detections and controls work, which is a different question from whether your application can be broken into. Price: not published. attackiq.com.
10. Vonahi vPenTest
Automated network penetration testing built for managed service providers and internal teams running a monthly cadence. Vonahi publishes that vPenTest goes beyond identifying vulnerabilities by actually exploiting them, performs exploits, man-in-the-middle attacks, hash cracking and privilege escalation, streams a real-time activity log that can be correlated against a SIEM to find monitoring gaps, and returns a report within 48 hours of test completion. Price: not published on vonahi.io; the site routes to a pricing quote form. vonahi.io.
11. Pentest-Tools.com
The toolkit end of the category, and the most price-transparent entry on this list. Automated exploitation is genuinely present in the Pentest Suite tier through Sniper Auto-Exploiter and dedicated SQL injection and cross-site scripting exploiters, sold per asset, where an asset is defined as a single hostname or IP address. This is an operator's toolkit rather than a managed engagement, so the output quality is a function of who is driving it. Price: NetSec from US$95 a month, WebNetSec from US$140 a month, Pentest Suite from US$190 a month, each at five assets. pentest-tools.com/pricing.
The ranking in one table
Rank | Platform | Category | Proof of exploitation published | Published price | Escalation to accredited human-led testing | Source |
|---|---|---|---|---|---|---|
1 | Stingrai | Autonomous web agent inside a CREST-accredited firm | Yes, evidence per finding | US$3,000 one-time, US$650 per month | Yes, across every scope | |
2 | Horizon3.ai NodeZero | Autonomous network exploitation | Yes, proof of exploit and attack path | Not published | Not published | |
3 | Cobalt Autonomous Pentest | Autonomous web agent inside a PTaaS platform | Yes, platform-delivered findings | US$3,500 per test, promotional to 31 Dec 2026 | Yes, within the platform | |
4 | Intruder | Same-day white-box web pentest | Yes, audit-usable report with refund guarantee | US$3,500 per test, US$12,000 for four | Not published | |
5 | Astra Security | Autonomous pentest tier plus manual tiers | Yes, on pentest tiers | US$2,999 a year per target | Yes, on Pentest Expert and Enterprise | |
6 | BreachLock | Autonomous engine with manual validation | Yes, every finding manually validated | Not published | Yes, within the service | |
7 | RidgeBot | Autonomous exploitation and validation | Yes, real proof-of-concept code | Not published | Not published | |
8 | Picus Security | Breach and attack simulation, exposure validation | Yes, for control validation and exploit chains | Not published | Not published | |
9 | AttackIQ | Breach and attack simulation, exposure validation | Not published as exploitation proof | Not published | Not published | |
10 | Vonahi vPenTest | Automated network penetration testing | Yes, publishes that it exploits rather than only identifies | Not published | Not published | |
11 | Pentest-Tools.com | Operator toolkit with automated exploiters | Yes, auto-exploiter modules | From US$95 a month per five assets | Not applicable, self-serve |
Automated versus manual: the comparison worth making
Framing this as a contest produces bad purchases in both directions. The published evidence supports a different framing: the two run best concurrently, on the same engagement, because the failure modes do not overlap.
What automation is structurally better at. Breadth, repetition and cadence. Enumerating 8,000 hosts. Running on every release rather than once a year. Parallel exploitation. Cost per hour. None of that degrades at 2am on day four.
What people are structurally better at. Building a model of what the business is supposed to do and then noticing the transaction that breaks it. The live-network study localises this precisely: the human lead came from a critical remote code execution bug that 80% of the professionals found and the best agent needed hints to reach. Add the AutoPenBench ratio, 21% autonomous against 64% with assistance, and the conclusion is arithmetic rather than ideology.
The wrong question is "which one". The right question is which surface carries your risk and what your auditor requires. A weekly-shipping web application wants continuous automated coverage with people on the engagement for the authorisation and business logic work. An annual PCI DSS obligation wants a qualified, independent tester and a documented methodology. Most organisations with both needs buy both, and the cheapest way to do that is from one provider who can do both. The division of labour is set out in detail in autonomous versus human pentesting scope split.
How to evaluate an automated penetration testing platform
Seven questions, all answerable before a contract:
"Show me one Medium-severity finding from a redacted report." Not a Critical. Anyone can write up a Critical. If a developer could not reproduce the Medium without asking a question, the product is a detector with better marketing.
"Which OWASP APTS autonomy level does this operate at, and which conformance tier do you target?" APTS gives you vocabulary for scope enforcement, safety, human oversight and auditability. Use it.
"What will it refuse to do, and how is that enforced?" 46 of the standard's 173 requirements cover scope enforcement and safety. A vendor with no written answer has not thought about it.
"What is your false-positive rate, measured how, on what corpus?" A rate without a denominator is a number without a meaning.
"Does my auditor accept this report for the framework I am actually being assessed against?" Ask before, not after. PCI DSS 11.4 and FedRAMP attach conditions to the tester, not the tool.
"What happens when the automation cannot finish the scope?" Either the provider puts penetration testers on it, or you start a second procurement.
"What does it cost, in the unit I buy in?" Per test, per target, per asset, per credit and per month are five different things. Convert everything to cost per application per year before comparing. The PTaaS pricing comparison does that arithmetic across the category.
For a wider tool-by-tool view across eight product classes, including open-source options and LLM red-team specialists, see the best AI pentesting tools guide.
What this means for buyers
Sort by category before you sort by price. A breach and attack simulation platform and an autonomous web agent solve different problems and cannot be compared on a price column.
Buy proof, not detection. The published differentiator across this list is whether the vendor states that its product demonstrates exploitation. Six of the eleven do, in their own words, on their own sites.
Check the auditor's requirement before the product demo. Where a framework names a qualified independent tester or an accredited assessor, an automated report is input rather than discharge.
Price the escalation, not just the automation. The expensive surprise is not the subscription, it is the second procurement when the scope outgrows the tool.
Seven of eleven publish nothing. Any number attached to those seven on a third-party site is somebody's estimate. Ask the vendor, and write the date next to the answer.
Match cadence to release frequency, and cadence to the calendar. Continuous automated coverage answers "did last Thursday's deploy break something". An annual engagement answers "what does an attacker do with a week and a full scope". They are different purchases.
Frequently Asked Questions
What is an automated penetration testing platform?
An automated penetration testing platform runs discovery, exploitation and reporting against a defined scope with little or no operator involvement. The term covers four distinct product categories: vulnerability scanners and DAST, which detect known-class issues; breach and attack simulation, which tests whether your controls block and detect known adversary techniques; exposure and adversarial validation, which ranks which known exposures are actually reachable; and autonomous exploitation agents, which chain weaknesses and safely exploit them to produce proof of an attack path. Only the last category attempts what a penetration test attempts, and the published benchmark evidence puts clear limits on how far it gets alone.
Can automated penetration testing replace manual penetration testing?
Not on the published evidence, and not for most compliance obligations. On AutoPenBench, a 33-task benchmark, a fully autonomous agent reached a 21% success rate against 64% for the same agent with human assistance. On a live 8,000-host network, the best agent placed second against ten working professionals, and 80% of those professionals found a critical remote code execution bug the agent reached only with hints (arXiv 2512.09882). Automation wins on breadth, cadence and cost per hour. People win on business logic, authorisation and creative chaining. Running both concurrently on the same engagement is what the measurements support.
Do auditors accept automated penetration testing reports?
It depends entirely on the framework. SOC 2 and ISO 27001 do not mandate penetration testing by name and generally accept a test report as evidence for a control you documented yourself. PCI DSS v4.0.1 is stricter: Requirement 11.4.1 demands a documented methodology with application-layer coverage, and 11.4.2 and 11.4.3 require a qualified resource with organisational independence, while quarterly ASV scanning sits separately at 11.3.2 and does not satisfy 11.4. CMMC Level 3 requires both automated tools and ad hoc tests by subject matter experts. FedRAMP requires a 3PAO report. Confirm the requirement before you buy, using the framework-by-framework guide.
What is the best automated penetration testing platform in 2026?
Stingrai ranks first on this page, because its Autonomous tier covers one web application and its APIs at a published US$3,000 one-time or US$650 per month with a No High or Critical Finding = Don't Pay guarantee, and because it sits inside a CREST-accredited penetration testing firm whose penetration testers can take any scope the automation cannot finish. Horizon3.ai NodeZero is the strongest network-side autonomous option. Cobalt and Intruder both publish a per-test price with retesting included. Astra publishes the lowest annual per-target figure. The right answer depends on whether your risk sits in an application, a network or a control stack.
What is the difference between automated penetration testing and breach and attack simulation?
They answer opposite questions. An autonomous penetration testing agent attacks your systems to find and prove exploitable weaknesses, producing findings with a reproduction path. Breach and attack simulation replays known adversary techniques to measure whether your existing controls block and detect them, producing a control-efficacy report. Picus publishes breach and attack simulation as its primary offering, continuously testing what EDR, SIEM, firewall and WAF controls actually stop. AttackIQ sells in the same category. Neither replaces an application penetration test, and an application penetration test does not tell you whether your SIEM alerted.
How much does an automated penetration testing platform cost?
Four of the eleven platforms on this page publish a figure. Astra publishes US$2,999 a year for Pentest Auto against one target. Stingrai publishes US$3,000 one-time or US$650 per month for an Autonomous Pentest of one web application and its APIs. Cobalt publishes US$3,500 per test on a promotional rate that must be initiated and completed before 31 December 2026. Intruder publishes US$3,500 per test and US$12,000 for a four-test pack. Pentest-Tools.com publishes per-asset plans from US$95, US$140 and US$190 a month at five assets. Horizon3.ai, BreachLock, RidgeBot, Picus, AttackIQ and Vonahi publish nothing.
What is OWASP APTS and why does it matter when buying?
The OWASP Autonomous Penetration Testing Standard is a governance standard for autonomous penetration testing platforms, covering safe, transparent and bounded operation rather than testing methodology. Version 0.1.0 defines 173 tier-required requirements across 8 domains: Scope Enforcement, Safety Controls, Human Oversight, Graduated Autonomy, Auditability, Manipulation Resistance, Supply Chain Trust and Reporting. It sets three conformance tiers and four autonomy levels from L1 Assisted to L4 Autonomous (OWASP APTS). It matters commercially because it gives a buyer precise language for the questions that used to get vague answers: what will the agent refuse to do, who can stop it, and what audit trail does it leave.
Are autonomous penetration testing agents safe to run against production?
The honest answer is that safety is a property of the product's scope enforcement, not of the category. This is exactly what OWASP APTS was written to address: 26 of its 173 requirements cover scope enforcement and another 20 cover safety controls, which tells you what practitioners considered the real risk. Ask any vendor for a written statement of what the agent will refuse to touch, how scope is bounded, how an operator halts a run immediately, and what audit trail survives afterwards. Platforms that publish agentless or ephemeral-infrastructure designs, such as NodeZero, give you something concrete to evaluate. A vendor with no written answer is not ready for your production environment.
How accurate are automated penetration testing tools?
Accuracy tracks whether the product proves exploitation. A platform that demonstrates an exploit has a structurally low false-positive rate, because a finding that cannot be exploited never gets written. A platform reporting evidence of a condition will always carry noise, and the live-network study explicitly records higher false-positive rates for agents than for human professionals (arXiv 2512.09882). For a reference point on the human side, Stingrai's State of Penetration Testing 2026 reports a 0.74% false-positive rate across 1,206 verified findings from 55 tests. Ask every vendor for a rate, a denominator and the corpus it was measured on.
What can automated penetration testing not find?
Chiefly the flaws that require a model of what the application is supposed to do. Broken access control is the clearest case: OWASP publishes that "100% of the applications tested were found to have some form of broken access control" for A01:2025, across 40 mapped CWEs and 32,654 CVEs (OWASP Top 10:2025). An IDOR is a well-formed request carrying the wrong identifier, and nothing about it looks anomalous to a pattern matcher. Add business logic bypasses, multi-step chained exploits, GUI-driven attack paths and the final judgement about whether a finding is genuinely exploitable, all of which the published research names as residual gaps.
Related Reading
AI Pentest Benchmark Results (2026), the full roundup of public benchmarks behind the evidence sections above.
Best AI Pentesting Tools (2026), a wider tool-by-tool view across eight product classes.
AEV vs BAS vs PTaaS vs Autonomous Pentest, the acronym decoder for this category.
Autonomous vs Human Pentesting: the Scope Split, where each side of the engagement earns its keep.
Acceptable False-Positive Rate for an Autonomous Pentest (2026).
Penetration Testing Requirements by Framework (2026), what each auditor actually asks for.
PTaaS Pricing Compared (2026), the per-unit arithmetic across published prices.
The State of Penetration Testing 2026, the findings dataset behind the output figures here.
Talk to Stingrai
The useful conversation is not automated against manual. It is which surface carries your risk, what your auditor names in writing, and who covers the part the automation cannot finish.
Book a free scoping call to walk through scope and the framework you are being assessed against, get a quote for a network, cloud, mobile or red team engagement with Stingrai's penetration testers, or read the published Autonomous and Hybrid web application package prices on the pricing page.
References
Lin et al. Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing. arXiv 2512.09882, 10 December 2025, revised 3 March 2026. https://arxiv.org/abs/2512.09882. Ten professionals against six agents plus ARTEMIS on roughly 8,000 hosts, with the second-place finish, the 82% valid submission rate and the cost-per-hour comparison.
Antonello et al. AutoPenBench: Benchmarking Generative Agents for Penetration Testing. arXiv 2410.03225, 4 October 2024. https://arxiv.org/abs/2410.03225. Thirty-three tasks, 21% success rate fully autonomous against 64% with human assistance.
Zhu, Kang et al. CVE-Bench. arXiv 2503.17332, March 2025. https://arxiv.org/abs/2503.17332. Best agent exploited 13% of critical web CVEs zero-day and 25% one-day.
OWASP. Top 10:2025, A01 Broken Access Control. Read 11 September 2026. https://top10.owasp.org/2025/A01_2025-Broken_Access_Control. Publishes that 100% of applications tested carried some form of broken access control, across 40 CWEs and 32,654 CVEs.
OWASP. Autonomous Penetration Testing Standard (APTS) v0.1.0. Read 11 September 2026. https://github.com/OWASP/APTS. 173 tier-required requirements across 8 domains, three conformance tiers and four autonomy levels.
Horizon3.ai. NodeZero Platform. Read 11 September 2026. https://horizon3.ai/platform/nodezero/. Agentless autonomous pentesting, attack-path chaining, proof of exploit and the named assessment scopes.
Cobalt. Pricing. Read 11 September 2026. https://www.cobalt.io/platform/pricing. Autonomous Pentest at US$3,500 per test with its 31 December 2026 deadline, the credit definition and free retesting on all tiers.
Intruder. Pentest pricing. Read 11 September 2026. https://www.intruder.io/pentest-pricing. US$3,500 per test, US$12,000 for four, white-box web application scope, unlimited retesting and the auditor-rejection refund.
Astra Security. Pricing. Read 11 September 2026. https://www.getastra.com/pricing. Pentest Auto described as an autonomous pentest, per-target pricing at US$2,999, US$5,999 and from US$9,999 a year, and the published re-scan entitlements.
BreachLock. Products. Read 11 September 2026. https://www.breachlock.com/products/. PTaaS, Continuous Penetration Testing, ASM, RTaaS and AEV, with the published split between the autonomous engine and manual validation.
BreachLock. Penetration Testing Pricing. Read 11 September 2026. https://www.breachlock.com/pricing/penetration-testing-pricing/. Standard, Extended and Extensive packages with re-test entitlements and no published figures.
Ridge Security. RidgeBot. Read 11 September 2026. https://ridgesecurity.ai/ridgebot/. Autonomous scanning, validation and safe exploitation using real proof-of-concept code, with the named coverage areas.
Picus Security. Security Validation Platform. Read 11 September 2026. https://www.picussecurity.com/product/security-control-validation. Breach and attack simulation, autonomous penetration testing and exposure validation.
AttackIQ. Products. Read 11 September 2026. https://www.attackiq.com/products/. Flex, Ready! and Enterprise, plus the agentic layer and command centre.
Vonahi Security. vPenTest. Read 11 September 2026. https://www.vonahi.io/. Automated network penetration testing that exploits rather than only identifies, with monthly cadence, real-time activity logging and 48-hour reporting.
Pentest-Tools.com. Pricing. Read 11 September 2026. https://pentest-tools.com/pricing. NetSec, WebNetSec and Pentest Suite per-asset plans, and the automated exploiter modules.
Stingrai. Pricing. Read 11 September 2026. https://www.stingrai.io/pricing. Published Autonomous and Hybrid package prices for one web application and its APIs, retest inclusion and the Autonomous tier guarantee.
Stingrai. The State of Penetration Testing 2026. https://www.stingrai.io/blog/state-of-penetration-testing-2026. 1,206 verified findings across 55 penetration tests, with severity distribution, false-positive rate and remediation timing.
Stingrai. Penetration Testing Requirements by Framework (2026). https://www.stingrai.io/blog/penetration-testing-requirements-by-framework-2026. What SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, CMMC, DORA and NIS2 each require and what evidence auditors accept.
Stingrai. PCI DSS Penetration Testing: Requirement 11.4 (2026). https://www.stingrai.io/blog/pci-dss-penetration-testing-2026. The 11.4 sub-requirements, the methodology conditions and the separation from ASV scanning at 11.3.2.
