The latest findings from Cobalt’s State of Pentesting Report 2026 reveal a striking shift in how enterprises view artificial intelligence as a tool for vulnerability discovery. After two years of enthusiastic adoption, confidence in fully automated AI scanners has plummeted, with the proportion of organizations depending exclusively on these tools dropping from nearly a third to under one‑tenth. This erosion of trust is not a fleeting reaction; it stems from measurable shortcomings in the scanners’ ability to uncover critical flaws, leaving security teams uneasy about relying on algorithms that repeatedly miss serious issues. The report, based on surveys of roughly 450 cybersecurity practitioners across the UK and EMEA, underscores a growing consensus that while AI brings speed, it cannot yet replace the nuanced judgment required to spot sophisticated weaknesses in modern applications. Moreover, the data show that over three‑quarters of respondents believe fully automated scanning tools fail to detect high‑risk vulnerabilities, a statistic that has prompted many to reconsider their reliance on pure automation. As a result, nearly half of the surveyed organizations now favor a hybrid approach that pairs machine efficiency with human expertise, signalling a pragmatic pivot toward balanced security testing strategies.
The survey data illustrate a clear migration away from monolithic reliance on AI‑only testing. In 2025, 29 % of respondents said they entrusted all vulnerability assessments to automated AI engines; by 2026 that figure had collapsed to just 9 %. Conversely, the share of firms advocating a hybrid model—where human analysts guide, validate, and enrich AI‑generated results—rose by 22 percentage points, reaching 47 % of the total sample. A parallel trend emerged in the treatment of low‑risk environments: the proportion of organizations that feel comfortable using automation for non‑critical systems also climbed by 22 points, settling at 47 %. These numbers suggest that security teams are not abandoning AI altogether; rather, they are segmenting its use, deploying it where the stakes are modest and reserving human scrutiny for high‑value assets. The hybrid model acknowledges the speed and breadth that machines provide while compensating for their blind spots through contextual analysis, threat hunting, and manual verification of flagged items. This strategic reallocation reflects a maturing understanding of AI’s strengths and limitations, and it aligns with broader industry movements toward risk‑based testing frameworks.
False negatives pose a particularly insidious threat because they create a dangerous illusion of safety. When an automated scanner reports that a system is clean, stakeholders may defer patches, postpone remediation, or allocate resources elsewhere, all while a critical weakness remains exploitable. The Cobalt study found that 78 % of participants had observed their AI‑driven scanners missing vulnerabilities that later proved to be high‑risk or even catastrophic in nature. Such oversights can translate directly into breaches, data loss, regulatory penalties, and reputational harm, especially in sectors where compliance mandates rigorous vulnerability coverage. Moreover, the financial cost of addressing a flaw after it has been exploited often dwarfs the expense of fixing it during a proactive test. By eroding confidence in the reliability of AI outputs, false negatives force security leaders to invest additional time in manual verification, effectively negating the efficiency gains that automation promised. This paradox—where the very tool meant to save labor ends up demanding more of it—has become a central talking point in boardroom discussions about the ROI of AI‑centric security initiatives.
A major factor behind the rise in false negatives is the intrinsic complexity of the AI‑driven attack surface that modern applications present. Unlike traditional software, where vulnerabilities often map to well‑understood code patterns such as buffer overflows or injection flaws, AI systems introduce layers of abstraction that obscure the underlying logic. Model weights, training data pipelines, inference endpoints, and dynamic prompt handling create a multifaceted environment where a single malicious input can propagate through numerous hidden layers before manifesting as exploitable behavior. Conventional signature‑based or heuristic scanners lack the architectural awareness needed to trace data flow through neural networks, making them prone to overlook subtle manipulations that alter model behavior without triggering obvious anomalies. Furthermore, the rapid pace of model iteration and the frequent reuse of third‑party components amplify the challenge, as scanners struggle to keep up with evolving architectures. Consequently, security teams are finding that effective testing of AI assets requires tools capable of interpreting model semantics, tracking data provenance, and simulating adversarial interactions at a depth that current automated offerings simply do not provide.
The report highlights a startling disparity in the severity of issues uncovered during AI‑focused penetration tests compared with assessments of conventional software. Approximately one in three findings generated from an AI pentest was classified as high risk, a figure that is 2.7 times higher than the average high‑risk hit rate observed in traditional application scanning. This skew suggests that when AI systems are probed, the vulnerabilities that do surface tend to be far more consequential—often involving model integrity, data poisoning, or logic flaws that could enable unauthorized decisions or privilege escalation. The heightened risk profile underscores why relying solely on automated tools is perilous: they may miss the very issues that pose the greatest danger to business operations and customer trust. At the same time, the abundance of high‑risk findings indicates that AI assets are attractive targets for sophisticated adversaries who recognize the potential payoff of compromising a machine‑learning pipeline. Organizations must therefore treat AI testing as a high‑priority activity, allocating sufficient skilled personnel and advanced methodologies to uncover these critical threats before they can be exploited in the wild.
Beyond detection, the speed and effectiveness of remediation paint a worrying picture for AI‑related security issues. At the time of the Cobalt analysis, only 38 % of identified LLM vulnerabilities had been patched or mitigated, leaving a substantial 62 % unresolved—the lowest resolution rate among all asset classes surveyed. This lag in fixing flaws is compounded by a noticeable increase in the mean time to resolve (MTTR) for AI/LLM problems, which rose from 19 days in 2025 to 36 days in 2026. The near‑doubling of MTTR indicates that security teams are grappling with vulnerabilities that are not only harder to detect but also more complex to remediate, often requiring changes to model architecture, retraining pipelines, or intricate input validation logic. Such delays widen the window of exposure, increasing the likelihood that adversaries can weaponize a known weakness before a fix is deployed. The trend also hints at potential skill gaps within security teams, as addressing LLM‑specific defects frequently demands expertise in machine‑learning engineering, data science, and secure software development—disciplines that may be underrepresented in traditional security operations centers.
Andrew Obadiaru, CISO at Cobalt, offered a candid assessment of the current state of AI‑driven testing, emphasizing that excitement around next‑generation Mythos‑class tools should be tempered by an awareness of their limitations. He warned that unsupervised algorithms are inclined to produce both an excess of false positives and, more troublingly, costly false negatives that surpass the error rates of legacy scanners. According to Obadiaru, the root cause lies in the inability of many automated solutions to grasp the architectural nuances of modern applications, particularly those that rely heavily on language models and other AI components. He advocated for a principled deployment strategy: assign automation to tasks where it excels—such as rapid scanning of large code bases for known patterns—while retaining elite human analysts to probe the intricate business‑logic risks that machines tend to overlook. By clearly delineating the roles of technology and talent, organizations can close the validation gap that currently undermines confidence in AI‑assisted security testing.
When examining the origins of AI‑linked security incidents, the Cobalt data point to several recurring vectors that dominate the threat landscape. Shadow AI—unsanctioned or undeployed machine‑learning models operating outside formal governance—emerged as the most frequent culprit, implicated in 44 % of reported cases. Close behind were data or model poisoning attacks and improper output handling, each accounting for 41 % of incidents. These findings highlight the dangers posed by weak model lifecycle management, where adversaries can inject malicious training data or tamper with model weights to skew predictions or create backdoors. Supply chain vulnerabilities followed at 35 %, reflecting the growing reliance on third‑party libraries, pre‑trained models, and APIs that may themselves contain hidden flaws. Finally, prompt injection techniques were observed in 34 % of events, underscoring how attackers manipulate the inputs to large language models to elicit unintended or harmful responses. Collectively, these vectors illustrate that securing AI systems extends beyond traditional code review; it demands vigilant oversight of data integrity, model provenance, runtime behavior, and the external components that feed into AI pipelines.
Despite a clear acknowledgment of the shortcomings in current AI testing capabilities, there is a notable disconnect between perceived needs and planned investments. The survey revealed that 60 % of security professionals believe their organizations require stronger LLM‑specific testing functions to keep pace with evolving threats. Yet only 42 % indicated they intend to expand human‑led red team operations aimed at uncovering AI‑centric weaknesses. This gap suggests that while many recognize the necessity of deeper human expertise, budgetary constraints, competing priorities, or a lack of qualified personnel may be hindering concrete action. It also raises the possibility that organizations are hoping to bridge the deficiency through incremental improvements to automated tools rather than committing to the specialized talent required for effective adversarial simulation of AI systems. To move beyond this stalemate, security leaders should consider targeted investments in upskilling existing staff, establishing dedicated AI security squads, or partnering with external specialists who possess the blend of machine‑learning knowledge and offensive security expertise necessary to conduct thorough red team engagements against modern AI assets.
The evolving landscape has not gone unnoticed by vendors, who are responding with new platforms that attempt to marry automation with human insight. Amazon Web Services, for example, recently unveiled Continuum, an AI‑powered vulnerability management solution that promises continuous monitoring, contextual risk scoring, and integrated workflow for remediation. Similar offerings from other cloud providers and specialized security startups emphasize features such as model‑aware scanning, automated generation of adversarial test cases, and dashboards that highlight the provenance of findings. While these innovations aim to reduce the manual burden associated with AI testing, industry analysts caution that no tool can fully substitute for the interpretive skills of seasoned security engineers when dealing with logic flaws, data poisoning, or sophisticated prompt‑based exploits. The market trend thus points toward a hybrid ecosystem where platforms provide scalable data collection and preliminary analysis, but ultimate validation and decision‑making remain firmly in the hands of human experts who can apply contextual business knowledge and creative threat modeling.
For organizations seeking to optimize their vulnerability management programs in light of these findings, a pragmatic framework begins with a clear segmentation of assets by risk and complexity. Low‑risk, well‑understood components—such as standard web front‑ends or routine API endpoints—can be subjected to fully automated scans that leverage signature databases and fast heuristic engines. Medium‑risk applications that incorporate AI elements but retain predictable architectures may benefit from semi‑automated pipelines where machines generate initial candidate findings that are then triaged by junior analysts. High‑value assets, particularly those involving custom language models, real‑time decision engines, or sensitive data pipelines, should undergo regular human‑led red team exercises complemented by targeted automated checks for known vulnerabilities. Additionally, establishing a continuous feedback loop—where insights from manual tests feed back into rule sets and machine‑learning models used by scanners—can gradually improve the accuracy of automation over time. Investing in threat‑intelligence feeds that focus on AI‑specific tactics, techniques, and procedures further enhances both automated detection and human hunting capabilities.
To translate these insights into concrete steps, security leaders should start by conducting an internal audit of existing AI testing practices, quantifying the proportion of reliance on fully automated tools versus human involvement. Based on the audit, define a target hybrid ratio that aligns with the organization’s risk appetite—many firms find a 50/50 split between automation and human expertise to be a reasonable starting point for high‑risk environments. Next, invest in training programs that upskill security analysts in machine‑learning fundamentals, data‑science methodologies, and AI‑focused threat modeling; certifications such as the AI Security Specialist or comparable credentials can help build internal capacity. Simultaneously, evaluate and potentially adopt vendor solutions that offer model‑aware scanning and continuous monitoring, ensuring they integrate smoothly with existing ticketing and SIEM systems. Finally, institute a regular cadence of red team exercises specifically tailored to AI assets, complemented by tabletop simulations that explore scenarios like data poisoning, prompt injection, and model theft. By blending scalable automation with deep human expertise, organizations can restore confidence in their vulnerability assessments and better defend against the evolving threats lurking within the AI attack surface.