Can AI actually pentest as well as a person?

Here's an honest take from our security researchers who've been helping to build our version. For web app testing, a human in the loop isn't necessary anymore, and a lot of that is recall, since an agent can hold an entire codebase in context in a way no human tester can.

Where AI clearly beats a human is on two specific things. IDORs, where a missing ownership check can hide anywhere in a large codebase and is easy to miss by hand. And multi-step bugs, where tracking how one action affects the next three is hard for a person and no trouble for an agent holding the whole app in context.

Andy Hornegold, our Chief Security Technologist, wrote the comparison:

• What an agent caught in apps humans had already tested
• Where the human expertise went, since it didn't disappear
• What they cost against consultant day rates

Worth a read if you're weighing one up against your next engagement: AI web app pentesting: everything you need to know