Agentic Pentesting Can Miss Inaccessible Assets and Vulnerabilities Without Exploits

Summary

Picus Security’s sponsored article says agentic pentesting can miss assets it cannot safely reach and vulnerabilities without usable exploits, and promotes combining it with exposure validation and breach-and-attack simulation.

Key points

The article says agentic testing can be costly, slow, and inconsistent, while deterministic tests offer repeatable, more frequent coverage.
An Omdia finding cited in the article says organizations pentest an average of 32% of their attack surface.
In a customer example, agentic testing reached 120 of 480 nginx-ui instances affected by CVE-2026-33032; 80 were confirmed exploitable and 40 were blocked.
The article says many vulnerabilities lack public exploit code; it cites VulnCheck’s finding that about one quarter of 2025 CVEs had PoC code or exploit details.
Picus says its Exposure Validation assesses attacker behaviors against security controls rather than requiring successful exploitation, including on assets agentic testing cannot reach.
Picus promotes combining autonomous pentesting, exposure validation, and breach-and-attack simulation in a shared workflow.