Security teams ditch AI-only pen testing

Cobalt’s 2026 AI and Pentesting Pulse Report and expert interviews show a sharp decline in trust for AI-only penetration testing—organizations dropped from 29% to 9% relying solely on AI—because automated tools miss critical vulnerabilities, produce many high-risk findings that are often unresolved, and struggle with AI-specific attack surfaces (prompt injection, retrieval risks, agent permissions). The article recommends a hybrid model: use AI for large-scale reconnaissance and repetitive validation while relying on experienced human testers for business-logic, chained exploits, and remediation, and emphasizes validating compiled artifacts and supply-chain checks before deployment.