Two things are true right now in offensive security.
The first is that AI is reshaping how pentests get done. Recon is now faster. Payload variants are easier to generate. Code review, regex and script generation, summarising long documents, drafting report sections - almost every part of the workflow has some AI in it now. Most pentesters I know have folded AI into how they work over the last eighteen months, and most engagements I oversee as a Technical Project Manager show traces of it somewhere in the process. And we are not at the ceiling. Frontier models from labs like Anthropic and others are pushing what AI can do in offensive security further with every release.
The second is that most pentests still succeed or fail for the same reasons they did five years ago. Did the tester understand what the customer actually needed? Did communication stay sharp through a tight engagement window? Did the report tell the customer something they could act on, in language that mattered to their business?
I've spent the last few years helping run pentests at scale on the management side, and the last five executing them as a Cobalt Core Lead. From both seats, the pattern is the same. AI is changing the pace of pentesting. It is not changing the point.
Here is what I'm seeing across hundreds of engagements: where AI is genuinely helping, where it is quietly making things harder, and what still has to come from a human.
What AI Is Actually Changing
AI has become part of the day-to-day for a lot of pentesters, and the productivity gain is real. Reconnaissance that used to take hours can be scoped down in minutes. Payload variants are easier to spin up. Code review on a large repository is faster when you can ask an LLM to flag suspicious patterns before you go in by hand. Regex, throwaway scripts, parsing odd output formats - all of it is faster.
It's affecting the report side too. Drafting initial sections, summarising long documents the customer shared during scoping, tightening language before submission. None of this replaces the tester's judgment, but it does free up time to spend on the parts that matter most.
Is it also introducing inflated expectations around increased productivity, and is that resulting in missouts, or are organizations and testers adjusting enough to focus on being the safety net for anything that AI is known to miss or hallucinate on?
What AI Is Quietly Making Harder
Customers are shipping AI features faster than they can secure them. According to Cobalt's 2026 State of Pentesting Report, 32% of AI and LLM findings are rated high risk, and the resolution rate for AI vulnerabilities is the lowest of any category in the report at 38%. This gap tells you that AI features are both more dangerous and harder to fix than the rest of what we test.
As a TPM, I'm seeing the scope mix shift. LLM-backed chatbots, RAG pipelines, agentic tools that take real actions on behalf of users, AI features bolted onto existing applications. Each of these brings testing challenges that didn't exist a few years ago. Prompt injection that chains into data exfiltration. Tool-use abuse in agentic systems. Trust boundary problems when an AI feature has more permissions than the user driving it. These need different testing approaches and often more time than a traditional web or API engagement of the same size.
There's a longer-term shift worth flagging, too. AI is making the surface to test more expensive, not less. The early narrative was that AI would make pentesting cheaper. That part is partly true on the tester's side. But the systems we're being asked to test are getting more complex, harder to remediate, and more business-critical. The cost is shifting from how we test to what we test. Anyone planning their security spend around "AI makes pentesting cheap" is going to be surprised by how much real assurance on AI systems actually costs.
What Frontier Models Like Mythos Change
The pace of change isn't linear anymore. Frontier models represent the absolute cutting edge of AI, and the leap from current production models to frontier-class models is already reshaping what's possible in offensive security.
The clearest example is Claude Mythos Preview from Anthropic. Anthropic describes it as a model that has reached a level of coding capability where AI can surpass all but the most skilled humans at finding and exploiting software vulnerabilities. In testing, Mythos has discovered hundreds of high-severity zero-day vulnerabilities, including a now-patched 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. These are bugs that survived decades of human review and millions of automated tests. Anthropic isn't releasing Mythos publicly, instead running Project Glasswing, a closed program where vetted security organizations use it defensively. The capability is real, and so is the trajectory.
For pentesters, this raises an obvious question: if a model can autonomously find decades-old vulnerabilities in some of the most hardened code on the planet, what's left for a human pentester to do? The answer hasn't changed. It's just gotten clearer.
Frontier models accelerate discovery. They don't replace context, business understanding, or the judgment to know what a finding actually means in a specific customer's environment. Cobalt's CEO compared frontier models to high-performance vehicles that require an elite driver. In less experienced hands, they're unpredictable and risky. In the hands of a skilled pentester or hacker, they're force multipliers. The discovery surface gets wider, the noise gets louder, and the work of separating signal from noise becomes more valuable, not less.
This is the moment Cobalt's human-led, AI-powered model is built for. The platform automates the rote work, autonomous reconnaissance, surface mapping, baseline scanning- so pentesters can spend their time on chained exploitation, business logic abuse, and the kinds of findings frontier models still struggle with. When Mythos-class capability becomes broadly available, and it will, the pentesters and programs that have already learned to work alongside AI rather than against it will be the ones still delivering value.
The frontier shift isn't a threat to pentesting. The work that always mattered- understanding the customer, asking the right questions, communicating with judgment, framing findings in language the business can act on, becomes the entire job. Everything else gets automated underneath it.
Why the Goal Still Has to Come From a Human
Customers don't all want the same thing. Some come in needing a pentest for compliance, whether that's SOC 2, PCI, ISO, or an upcoming audit. Some want comprehensive coverage of their environment. Some want a focused, deep look at one feature or service that just shipped. Some genuinely just want peace of mind before a release or a board meeting.
These are very different engagements, even when the scope on paper looks identical.
No AI tool can tell you which one a customer actually needs. That comes from a conversation. Read the brief carefully. Ask the question early. If you skip this step, you can deliver a technically clean report and still leave the customer unhappy, because you solved a problem they didn't ask you to solve.
The same is true from the customer side. The clearer you are about why you're running this pentest, the better the result you'll get. If it's for compliance, say so. If you've just shipped a new payment flow and want it stress-tested, say that. If you want broad coverage because you genuinely don't know where your weakest points are, that's a valid goal too, but it's a different engagement than a focused deep dive, and the testing team needs to know which one they're walking into. A good pentest team will ask. The best engagements are the ones where the customer already had the answer ready.
Why Communication Still Wins or Loses the Engagement
Pentests live or die on communication, and the modern pentest moves fast. Cobalt pioneered Pentesting as a Service with a two-week engagement model, and that timeline has become the standard across the industry. Two weeks doesn't leave room for slow communication. Every day a question goes unanswered, every day credentials don't work, every day scope stays unclear, is a day you don't get back. The option to extend exists, but extensions mean delays, awkward conversations, and lost momentum.
AI hasn't changed this part of the job. It can help draft a clearer update or summarise a long Slack thread, but it can't decide when to push a customer for clarification, when to flag a blocker, or when to slow down because something feels off. That judgment is still entirely human, and on a short engagement, it's worth more than any tool in the kit.
Customers play a bigger role here than they sometimes realise. The engagements that produce the most value are the ones where the security team stays reachable during the testing window. Replying to questions within a few hours instead of a few days. Flagging environment changes as they happen. The quiet customers usually leave findings on the table, not because the testers didn't try, but because the clock ran out before the questions could be answered.
Where Human Judgment Still Decides the Report
The customer might not read every Slack update during the engagement, but they will read the report. So will people who were never in the channel.
A strong finding has three things. Clear, reproducible repro steps that anyone on the customer's team can follow. Business impact framed in the customer's language, not just generic OWASP categories. And a severity rating that reflects the actual risk in their environment, not just the CVSS score in isolation.
A SQL injection on an internal admin tool used by three people is not the same as a SQL injection on a customer-facing login page, even if CVSS rates them identically. Spell that out. The customer should never have to guess why something is critical or why it isn't.
AI can help draft a finding. It can't decide what matters in a specific customer's environment. That requires having sat with the brief, asked the questions, watched the system behave, and understood what the business actually does. That's the work, and that's what customers are paying for.
This is also where customers can shape the quality of what they get back. The more context you share with the testing team about your business, which systems are critical, who uses what, where the sensitive data lives, the sharper and more actionable your findings will be.
The Collaboration AI Can't Replicate
Most engagements have more than one pentester on the pod, and the best findings often come from the collaboration between them. One tester spotting something another almost dismissed. A low finding on one endpoint chaining into a critical when paired with what someone else found elsewhere. Pentesters bouncing ideas off each other in the channel, building on each other's instincts.
As a TPM, I see this play out across engagements all the time. It's one of the best parts of the job to watch. AI can suggest payloads and surface patterns, but it can't sit in a pod with three other testers and improvise off what they just noticed. That kind of judgment-stacking is still entirely human, and it's where some of the most impactful findings come from.
The Mindset Shift Worth Internalising
The best pentesters aren’t the ones using the fanciest AI tools. They utilize their own judgement, bring unique expertise that no single tool can replicate. That’s what sets them apart from the hype.
Verifying what AI-generated output actually tells you, knowing when to trust the suggestion and when to think for yourself, recognising when a tool is confidently wrong - this is the new core skill. The pentesters who develop it will get faster without losing rigour. The ones who don't will produce shallower work, faster, and customers will notice.
The mindset shift isn't about using AI or refusing it. It's about owning the result either way. If you submit the finding, you stand behind it, regardless of how it was generated.
What Still Has to Be Human
After years of running pentests at scale and executing them as a Core Lead, here's how I'd define a successful pentest. The customer understood what they were going to get, got it, and knew exactly what was happening throughout. The findings are accurate, the report is clear, and there are no surprises, good or bad, at the end.
AI is changing the pace, not the point. The customer should still feel that a thoughtful person ran their pentest. They should feel like someone understood their environment, asked the right questions, and gave them findings they can act on. As mentioned previously, that judgement matters. Technical skill is the baseline, and everything above is what separates a pentest that gets renewed from one that doesn't.
Frontier models will keep getting better. The way you communicate will be remembered for years.
