What Does Automated Penetration Testing Actually Find?

This whitepaper explains automated penetration testing (APV): how it validates confirmed, exploitable attack paths (particularly identity and Active Directory chains) by executing exploits in a live environment, how it differs from vulnerability scanners and Breach and Attack Simulation, its coverage (AD/identity, lateral movement, host escalation) and key limitations (no web/API/business-logic testing, no discovery of zero‑days). It also covers operational guidance—false positive sources, run frequency, remediation verification—and positions APV as a focused tool for proving the shortest path to domain admin and tracking remediation progress.