{"slug": "more-pentesting-same-budget-no-surprises", "title": "More pentesting, same budget, no surprises", "summary": "Aikido's 2026 State of AI in Pentesting report found that 76% of organizations ship significant production changes weekly or faster, while only 21% validate security on every release, and 79% of respondents worry about vulnerabilities introduced between scheduled tests. The report also cites Zero Day Clock data charted by a16z showing the share of exploited CVEs hit on or before disclosure day rose from 18.7% in 2018 to 53.6% in 2025 and stands at 86.7% in 2026, while GitHub reported monthly commits grew from 1.4 billion in April 2026 to 2.9 billion by August. Aikido argues AI pentesting can test at release speed and be budgeted more predictably than manual engagements, which about 42% of teams delay retests on due to cost or scheduling.", "body_md": "Development teams ship faster than ever with AI-assisted coding. Features that previously took weeks can now be delivered in days. But security testing still runs on the old schedule. In Aikido's [2026 State of AI in Pentesting report](https://www.aikido.dev/state-of-ai-pentesting), we found that 76% of organizations deploy significant production changes weekly or faster, while just 21% validate security on every release.\n\nKatie Norton, Senior Research Manager at IDC, [summed it up](https://www.aikido.dev/state-of-ai-pentesting).\n\n\"Traditional penetration testing was built around periodic assessments, but modern software delivery no longer operates on a periodic schedule. As development velocity increases, especially with AI-assisted software creation, security testing will increasingly need to move closer to the release cycle itself.\"\n\nAnd with [attackers now equipped with AI](https://www.aikido.dev/blog/hacker-superpower-ai), organizations need to be on top of their game. The old thinking would be to increase security spending. But what if the better solution is to rethink how we spend it?\n\nAI pentesting can test at the speed teams release, and with the right pricing model, AI pentesting is easier to plan and budget than manual pentesting. Teams get more control over where their testing budget goes.\n\n## More code = more risk\n\nAI coding tools have sped up how quickly software gets built and shipped. GitHub recently [shared](https://github.blog/news-insights/company-news/the-august-17-outage-and-the-work-ahead/) that monthly commits on the site grew from 1.4 billion in April 2026 to 2.9 billion by August. In 2023, monthly commits were only around half a billion a month.\n\nEvery new endpoint or architectural change can introduce a vulnerability, and while they’re improving, AI coding agents still introduce a variety of vulnerabilities, like broken access controls and business logic flaws.\n\nAI is also changing what attackers can do, and they’re moving public flaws faster than they used to. Zero Day Clock data [charted by a16z](https://x.com/a16z/status/2107565314410230224) shows the share of exploited CVEs that attackers hit on or before the day of disclosure climbing from just 18.7% in 2018 to 53.6% in 2025. The 2026 figure, at the time of writing, is currently at a very high 86.7%.\n\nNot to sound cliché, but with code shipping faster than ever and attackers overpowered by AI, teams can’t afford to be behind on their security.\n\n## Manual pentesting is predictable, but expensive\n\nWhile the development world is changing, pentesting schedules have pretty much stayed the same. Many programs still run one deep assessment once or twice a year, so most of what goes into production between pentest engagements is untested. In our same [State of AI in Pentesting report](https://www.aikido.dev/state-of-ai-pentesting), 79% of respondents worry about missing vulnerabilities introduced between scheduled tests (which makes sense given how fast they ship!).\n\nA scoped manual engagement comes with a quote, so finance knows the cost before work starts. But every extra application or retest takes more time from skilled human testers, so doubling test frequency usually means asking for a much larger budget. Security teams can end up rationing coverage by choosing the few applications that their fixed budget can reasonably cover.\n\nYolanda Amorim, Application Security Manager at Believe, described [how this model doesn’t scale up](https://www.aikido.dev/state-of-ai-pentesting).\n\n\"When you're managing security across multiple regions and teams, you can't scale pentesting by adding more testers. The model breaks down as soon as the organization grows faster than your ability to schedule engagements.\"\n\nTrying to pentest more to keep up with faster code becomes… well, impossible. About [42% of teams delay retests](https://www.aikido.dev/state-of-ai-pentesting) because of cost or scheduling, and only 40% retest promptly after a fix. A team that had to skip the retest is assuming (read: hoping) that their fix worked.\n\n## Without changing your budget, AI pentesting gets you more coverage\n\nAI pentesting breaks the link between how much you test and how many tester hours you can afford. AI pentesting hands much of each assessment to AI agents. They map an application's attack surface and validate each potential vulnerability through real exploitation before it goes into the report.\n\nMoving that work from people to agents both:\n\n- lowers the cost of each test\n- shortens how long the test takes\n\nEach test costs less because agents do the work that billable tester hours used to cover, and they work through attack paths in parallel. While it varies a lot depending on your location and application, our internal benchmarking shows that the cost of a full scope pentest drops to less than half the price of human pentesting.\n\nAgents also return results in hours, compared with the 2.6-week average for a manual test, which doesn’t even include the time you wait for it to start and the additional retest time.\n\nThe goal isn't to replace every human pentest. Specialist-led assessments still have an important role, particularly for complex systems and high-assurance requirements. AI pentests should also be handled by your security pros, like human pentesters.\n\n## AI pentesting changes the cost of each test\n\nLower cost and faster turnaround make repeat testing practical. Most of the overhead of scheduling and contracting an engagement goes away, so teams can run smaller, targeted tests when a change calls for one.\n\nThe last thing a security leader needs is to replace the high cost of traditional pentesting with an unpredictable bill for AI-powered testing. With Aikido, the cost of each assessment is set before testing starts. Ongoing testing comes with a forecast and spending controls, so teams get on-demand testing and a number the finance team can approve. A budget that once covered annual assessments for just some of your critical applications can stretch across much more of your infrastructure.\n\n## AI tests at the pace your applications need\n\nDifferent applications vary in their risk level and how often they change. A customer-facing application with daily updates has very different testing requirements from an internal tool that changes twice a year. But traditional pentesting programs often put them on similar schedules.\n\nAI pentesting makes it more practical to move towards a risk-based testing strategy, where organizations determine both the depth and frequency of testing based on what matters most. Security teams get greater flexibility to allocate their budget and optimize for the best coverage.\n\nOne example approach sorts applications by business criticality and rate of change.\n\n- Crown jewels that change often get a deep AI baseline assessment, followed by incremental testing on security-relevant changes.\n- Lower-risk applications that change rarely stick to a yearly AI pentest as a documented baseline.\n\nAnd of course, you would retest fixes across both groups.\n\nBut importantly, more frequent testing doesn't have to mean testing everything, all the time. The objective is to find the right balance between coverage, frequency, risk, and cost that works best for the organization.\n\n## Budgeting for continuous pentesting\n\nBut what if you want to go further and test every risky change on the application? With the speed and cost of AI pentesting, it’s actually feasible to test every application continuously. Continuous AI pentesting retests an application as its code changes, so security validation keeps up with releases between full assessments.\n\nTesting every commit would waste budget, since most changes, like a new button color, don't affect the attack surface. Well-built continuous testing reviews each change first and only launches a test when the change is security-relevant. Cost then follows the volume of security-relevant changes.\n\nTeams can plan around continuous testing when the tool shows a forecast before they turn it on and publishes the price of each unit of testing. Control over how often it runs keeps that forecast realistic, and spending limits mean a busy development quarter can't produce an unexpected bill.\n\n[Aikido Infinite](https://www.aikido.dev/attack/infinite) works this way. Its pricing page shows a yearly estimate based on recent Git activity, and each agent it launches has a fixed credit price. Teams choose whether Infinite tests on every deploy or on a set schedule. Runs draw from a prepaid credit wallet, so they’re not getting surprise bills on their credit cards later.\n\nFor more on how change-aware testing works, read [what continuous pentesting actually requires](https://www.aikido.dev/blog/continuous-pentesting-requirements).\n\n## More flexibility shouldn't mean less budget control\n\nTrading the high cost of traditional pentesting for an unpredictable AI testing bill would hand security leaders a new budgeting problem. At Aikido, we think cost predictability belongs in how AI pentesting is priced from day one.\n\nJames Berthoty, Founder and Analyst at Latio, [sees AI opening up continuous testing to more teams](https://www.aikido.dev/state-of-ai-pentesting).\n\n\"AI goes a long way to democratize the dream of continuous pentesting for teams. No longer forced into the costly trade-offs of scoping full engagements, they're able to run meaningful testing as fast as they're shipping code.\"\n\nWhen teams know what each test will cost before it runs, they can put every dollar of the pentesting budget toward the applications and changes that need it.", "url": "https://wpnews.pro/news/more-pentesting-same-budget-no-surprises", "canonical_source": "https://www.aikido.dev/blog/more-pentesting-same-budget-ai", "published_at": "2026-10-19 09:00:00+00:00", "updated_at": "2026-10-19 10:47:07.024299+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "artificial-intelligence"], "entities": ["Aikido", "IDC", "Katie Norton", "GitHub", "a16z", "Believe", "Yolanda Amorim"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/more-pentesting-same-budget-no-surprises", "markdown": "https://wpnews.pro/news/more-pentesting-same-budget-no-surprises.md", "text": "https://wpnews.pro/news/more-pentesting-same-budget-no-surprises.txt", "jsonld": "https://wpnews.pro/news/more-pentesting-same-budget-no-surprises.jsonld"}}