Synack Survey Finds 87% Have Advanced Beyond Evaluating Agentic AI Pentesting

Summary

A Synack-commissioned, Omdia-conducted survey of 200 U.S. security professionals finds broad interest in agentic AI pentesting, but organizations report limited attack-surface coverage and favor human oversight, accuracy, and guardrails.

Key points

• The web survey covered 200 U.S. security professionals at enterprises with at least 1,000 employees; it was conducted December 11–22, 2025, and commissioned by Synack and conducted by Omdia.
• Respondents said their organizations test an average of 32% of their attack surface, despite 95% ranking penetration testing as a top or high priority.
• 87% said their organization had moved beyond evaluating agentic AI pentesting, including planning pilots, testing, or integration; 95% anticipated some replacement of traditional services.
• 64% preferred an agent-led model with human oversight; 22% favored fully autonomous testing. 93% said guardrails are important or critical.
• 69% said agentic AI would need accuracy of at least 85% compared with manual testing to be considered effective; this is a stated threshold, not a measured performance result.
• Among organizations not yet adopting agentic AI pentesting, 46% cited security concerns about AI systems, while 40% cited lack of trust in AI decisions and integration complexity.
• The report says AI-led testing may miss logic and context vulnerabilities, struggle with horizontal chaining across systems or accounts, and produce more false positives when fully autonomous.

Vendors