Development teams ship faster than ever with AI-assisted coding. Features that previously took weeks can now be delivered in days. But security testing still runs on the old schedule. In Aikido's 2026 State of AI in Pentesting report, we found that 76% of organizations deploy significant production changes weekly or faster, while just 21% validate security on every release.
Katie Norton, Senior Research Manager at IDC, summed it up. "Traditional penetration testing was built around periodic assessments, but modern software delivery no longer operates on a periodic schedule. As development velocity increases, especially with AI-assisted software creation, security testing will increasingly need to move closer to the release cycle itself."
And with attackers now equipped with AI, organizations need to be on top of their game. The old thinking would be to increase security spending. But what if the better solution is to rethink how we spend it?
AI pentesting can test at the speed teams release, and with the right pricing model, AI pentesting is easier to plan and budget than manual pentesting. Teams get more control over where their testing budget goes.
More code = more risk #
AI coding tools have sped up how quickly software gets built and shipped. GitHub recently shared that monthly commits on the site grew from 1.4 billion in April 2026 to 2.9 billion by August. In 2023, monthly commits were only around half a billion a month.
Every new endpoint or architectural change can introduce a vulnerability, and while they’re improving, AI coding agents still introduce a variety of vulnerabilities, like broken access controls and business logic flaws.
AI is also changing what attackers can do, and they’re moving public flaws faster than they used to. Zero Day Clock data charted by a16z shows the share of exploited CVEs that attackers hit on or before the day of disclosure climbing from just 18.7% in 2018 to 53.6% in 2025. The 2026 figure, at the time of writing, is currently at a very high 86.7%.
Not to sound cliché, but with code shipping faster than ever and attackers overpowered by AI, teams can’t afford to be behind on their security.
Manual pentesting is predictable, but expensive #
While the development world is changing, pentesting schedules have pretty much stayed the same. Many programs still run one deep assessment once or twice a year, so most of what goes into production between pentest engagements is untested. In our same State of AI in Pentesting report, 79% of respondents worry about missing vulnerabilities introduced between scheduled tests (which makes sense given how fast they ship!). A scoped manual engagement comes with a quote, so finance knows the cost before work starts. But every extra application or retest takes more time from skilled human testers, so doubling test frequency usually means asking for a much larger budget. Security teams can end up rationing coverage by choosing the few applications that their fixed budget can reasonably cover.
Yolanda Amorim, Application Security Manager at Believe, described how this model doesn’t scale up. "When you're managing security across multiple regions and teams, you can't scale pentesting by adding more testers. The model breaks down as soon as the organization grows faster than your ability to schedule engagements."
Trying to pentest more to keep up with faster code becomes… well, impossible. About 42% of teams delay retests because of cost or scheduling, and only 40% retest promptly after a fix. A team that had to skip the retest is assuming (read: hoping) that their fix worked.
Without changing your budget, AI pentesting gets you more coverage #
AI pentesting breaks the link between how much you test and how many tester hours you can afford. AI pentesting hands much of each assessment to AI agents. They map an application's attack surface and validate each potential vulnerability through real exploitation before it goes into the report.
Moving that work from people to agents both:
- lowers the cost of each test
- shortens how long the test takes
Each test costs less because agents do the work that billable tester hours used to cover, and they work through attack paths in parallel. While it varies a lot depending on your location and application, our internal benchmarking shows that the cost of a full scope pentest drops to less than half the price of human pentesting.
Agents also return results in hours, compared with the 2.6-week average for a manual test, which doesn’t even include the time you wait for it to start and the additional retest time.
The goal isn't to replace every human pentest. Specialist-led assessments still have an important role, particularly for complex systems and high-assurance requirements. AI pentests should also be handled by your security pros, like human pentesters.
AI pentesting changes the cost of each test #
Lower cost and faster turnaround make repeat testing practical. Most of the overhead of scheduling and contracting an engagement goes away, so teams can run smaller, targeted tests when a change calls for one.
The last thing a security leader needs is to replace the high cost of traditional pentesting with an unpredictable bill for AI-powered testing. With Aikido, the cost of each assessment is set before testing starts. Ongoing testing comes with a forecast and spending controls, so teams get on-demand testing and a number the finance team can approve. A budget that once covered annual assessments for just some of your critical applications can stretch across much more of your infrastructure.
AI tests at the pace your applications need #
Different applications vary in their risk level and how often they change. A customer-facing application with daily updates has very different testing requirements from an internal tool that changes twice a year. But traditional pentesting programs often put them on similar schedules.
AI pentesting makes it more practical to move towards a risk-based testing strategy, where organizations determine both the depth and frequency of testing based on what matters most. Security teams get greater flexibility to allocate their budget and optimize for the best coverage.
One example approach sorts applications by business criticality and rate of change.
- Crown jewels that change often get a deep AI baseline assessment, followed by incremental testing on security-relevant changes.
- Lower-risk applications that change rarely stick to a yearly AI pentest as a documented baseline.
And of course, you would retest fixes across both groups.
But importantly, more frequent testing doesn't have to mean testing everything, all the time. The objective is to find the right balance between coverage, frequency, risk, and cost that works best for the organization.
Budgeting for continuous pentesting #
But what if you want to go further and test every risky change on the application? With the speed and cost of AI pentesting, it’s actually feasible to test every application continuously. Continuous AI pentesting retests an application as its code changes, so security validation keeps up with releases between full assessments.
Testing every commit would waste budget, since most changes, like a new button color, don't affect the attack surface. Well-built continuous testing reviews each change first and only launches a test when the change is security-relevant. Cost then follows the volume of security-relevant changes.
Teams can plan around continuous testing when the tool shows a forecast before they turn it on and publishes the price of each unit of testing. Control over how often it runs keeps that forecast realistic, and spending limits mean a busy development quarter can't produce an unexpected bill.
Aikido Infinite works this way. Its pricing page shows a yearly estimate based on recent Git activity, and each agent it launches has a fixed credit price. Teams choose whether Infinite tests on every deploy or on a set schedule. Runs draw from a prepaid credit wallet, so they’re not getting surprise bills on their credit cards later.
For more on how change-aware testing works, read what continuous pentesting actually requires.
More flexibility shouldn't mean less budget control #
Trading the high cost of traditional pentesting for an unpredictable AI testing bill would hand security leaders a new budgeting problem. At Aikido, we think cost predictability belongs in how AI pentesting is priced from day one.
James Berthoty, Founder and Analyst at Latio, sees AI opening up continuous testing to more teams. "AI goes a long way to democratize the dream of continuous pentesting for teams. No longer forced into the costly trade-offs of scoping full engagements, they're able to run meaningful testing as fast as they're shipping code."
When teams know what each test will cost before it runs, they can put every dollar of the pentesting budget toward the applications and changes that need it.