Photo by Andrea De Santis on Unsplash - Thank you!
While you’re scheduling next quarter’s pen test, an AI-powered attacker is already inside your network and it got there before lunch!
Here’s the uncomfortable truth about the pen testing industry in 2026. The annual engagement is broken. The autonomous only pitch is overselling. Both camps are competing to replace each other, and both are wrong.
Your attackers have already figured this out. They use automation for scale and human creativity for the hard problems. Your defence needs to do the same.
Why the Annual Pen Test Alone Fails
Four structural gaps make point-in-time testing insufficient on its own:
Scheduling. Code ships daily. A Tuesday vulnerability may go undiscovered until next spring.
Coverage. A traditional manual test typically covers less than 1% of the network.
Wrong model. Most major 2025 breaches (Drift OAuth, Shai-Hulud, DragonForce) involved no CVEs at all. They exploited trust, tokens, and integrations.
Identity blind spot. Group-IB calls identity “the dominant choke point” of 2026. Most pen tests still focus on the network layer.
Meanwhile, the exploitation timeline has collapsed. VulnCheck's 2026 State of Exploitation report found that 29% of newly exploited CVEs in 2025 were weaponised on or before the day of disclosure. Mandiant's M-Trends 2025 data goes further: the average time-to-exploit in 2025 was negative one day. Attackers are exploiting vulnerabilities before the patches exist. Meanwhile, 50% of critical CISA KEV vulnerabilities remain unpatched 55 days after a fix ships. Defenders need nearly two months; attackers need less than zero.
The volume is crushing, too. Over 50,000 CVEs were published in 2025, roughly 131 every single day. AI-driven scanning infrastructure now sweeps the public internet at 36,000 scans per second. Ransomware groups like Qilin and DragonForce industrialised in 2025, Cl0p ran one of the most aggressive extortion waves of the year through a single Oracle E-Business Suite zero-day, and state actors now deploy AI-generated "synthetic insiders" through hiring pipelines to infiltrate organisations from within.
The annual pen test was designed for a threat model that no longer exists.
The Hybrid Model
Autonomous testing and human testing solve different problems, combining them is the right strategy.
Autonomous wins on:
Continuous coverage. Every day, not once a year.
Scale. Every asset, identity, and integration. Not just the top 1%.
Speed. First findings in hours. Instant retest after fixes.
Regression. Every deployment and config change, revalidated automatically.
Humans win on:
High-impact critical assets. A trading engine. A licensed gaming platform. A crypto custody wallet. Places where a senior tester’s depth beats any scanner.
Business logic flaws. Bonus abuse, refund race conditions, IDOR across user boundaries. Every request looks valid. The flaw is in intent, not syntax.
Adversary simulation. CBEST and TIBER-EU exercises demand intelligence-led, threat-modelled, human-designed campaigns. Autonomous tools alone don’t do this.
The RSA Conference 2026 consensus put it plainly: AI provides scale and speed, humans deliver judgment and context. Gartner made this official in its March 2026 Market Guide for Adversarial Exposure Validation, projecting 60% of organisations will adopt continuous exposure validation by 2029.
Why Regulated Organisations Need Both
For regulated firms, hybrid is not just better security. It is the only architecture that actually satisfies the regulators. Every major framework now combines cadence obligations that only autonomous testing can economically meet with accredited-tester obligations that only humans can satisfy:
Financial services (EU): DORA Articles 25 to 27 require quarterly vulnerability assessments, annual pentests, and three-yearly TLPT under TIBER-EU. National regulators are moving fast: Malta’s MFSA has already adopted TIBER-EU as TIBER-MT and expects alignment with ISO 27001 and the NIST Cybersecurity Framework. Fines up to 2% of global turnover.
Financial services (UK): Bank of England CBEST mandates intelligence-led human exercises.
Cards (any sector): PCI DSS 4.0.1 Requirement 11.4 demands annual qualified-independent testing; 11.4.6 demands six-monthly segmentation testing for service providers.
iGaming: UKGC RTS, MGA, and IoM GSC require ISO 27001-based annual audits and pre-deployment testing. Business logic flaws (bonus abuse, RNG manipulation, payment race conditions) directly threaten licences.
UAE (Dubai): DFSA-regulated firms in the DIFC must conduct annual independent penetration testing of all material systems under the DFSA Cyber Risk framework, with more frequent testing for high-risk firms. Outside the DIFC, VARA's Technology & Information Rulebook (effective May 2025) mandates annual Threat-Led Penetration Testing by independent external testers, quarterly vulnerability scanning, and continuous monitoring for all VASPs. Non-compliance puts the licence at risk.
Crypto (CASPs): MiCA plus DORA impose Web2+Web3 audits, quarterly assessments, three-yearly TLPT, four-hour incident reporting, and fines up to €20m or 5% of turnover.
Essential and important entities (NIS2): The EU Network and Information Security 2 Directive covers 18 sectors including energy, health, manufacturing, digital infrastructure, and MSPs. Article 21 requires proportionate, demonstrable, risk-based measures and continuous evaluation of their effectiveness. Fines up to €10m or 2% of global turnover for essential entities.
UK public sector: CHECK, PSN, ITHC, and NHS MESH require accredited human testers. Autonomous platforms supplement; they don’t replace.
The Endida Hybrid Programme
Endida delivers the autonomous layer through NodeZero from Horizon3.ai, a Gartner-recognised Adversarial Exposure Validation platform named one of Fast Company’s Most Innovative Companies of 2026. Horizon3.ai sits on that list alongside Google, Nvidia, Adidas, and Walmart. We wrap the platform with the accredited human expertise your regulator expects.
NodeZero runs a continuous Find, Fix, Verify loop across eight operations: internal and external pentests, cloud (AWS, Azure, Kubernetes), Active Directory, phishing impact, EDR validation, rapid zero-day response, and web apps. It exploits real attack paths, prioritises by business impact, and retests after every fix.
Production numbers:
98%+ network coverage, versus less than 1% for a traditional test.
First findings in under 3 hours.
Domain compromise in as little as 77 seconds in real environments.
50,000+ vulnerabilities discovered across defence contractors in the NSA CAPT programme, with 70% remediated.
On top of this foundation, Endida scopes targeted human engagements for exactly the work autonomous platforms cannot do: CBEST, TIBER-EU, UKGC annual audits, MiCA/DORA TLPT, red team simulations, and business logic testing on your most sensitive applications.
On 31 March 2026, AWS made its Security Agent generally available at $50 per task-hour. When a hyperscaler enters the category at that price, the signal is clear. Autonomous testing is becoming infrastructure. The differentiation moves upward, to hybrid programmes that combine continuous coverage with accredited expertise and regulatory rigour. That is where Endida sits.
See What an Attacker Sees
Endida offers a free trial and proof-of-value engagement. NodeZero deployed in your environment. Real exploitable vulnerabilities identified with proof-of-exploit evidence. No agents, no obligation, no disruption.
From there we design your hybrid programme against whichever frameworks apply to you.
Flexible pricing for mid-market, enterprise, regulated financial services, iGaming, CASPs, and MSP partners.
Stop choosing. Start combining.
Endida’s Continuous Penetration Testing Platform
Threat data: Group-IB High-Tech Crime Trends 2026, IBM X-Force 2026 Threat Intelligence Index, Horizon3.ai production data. Regulatory references: EU DORA Articles 24 to 27, TIBER-EU (2025 update), TIBER-MT (MFSA 2025 adoption), MFSA Guidance on ICT and Security Risk Management, MiCA, Bank of England CBEST, GFSC Cyber Security Rules 2021, UKGC RTS, MGA and IoM GSC requirements, PCI DSS v4.0.1 (11.4, 11.4.4, 11.4.6), NCSC CHECK, NHS DSPT, ISO/IEC 27001:2022, NIST Cybersecurity Framework v2.0, UK GDPR Article 32, EU Network and Information Security 2 Directive (NIS2) Article 21, Gartner March 2026 AEV Market Guide, Fast Company Most Innovative Companies 2026. Not legal or audit advice. Compliance obligations vary by jurisdiction, sector, licence class, and risk. NodeZero is a registered product of Horizon3.ai. Endida is an authorised PTaaS partner.