Trust in Automated AI Vulnerability Scanning Collapses to 9%, New Study Finds

The Cobalt State of Pentesting Report 2026, based on surveys of ~450 security professionals, documents declining trust in fully automated AI vulnerability testing and a shift toward hybrid human+AI models. It reports that automated scanners commonly miss critical issues, nearly one-third of AI pentest findings are high risk, only 38% of LLM vulnerabilities were fixed, MTTR rose from 19 to 36 days, and common incident vectors include shadow AI, data/model poisoning, improper output handling, supply-chain weaknesses, and prompt injection.