The rise of intelligent digital workers and autonomous AI agents is compounding an urgent cybersecurity challenge: attack surfaces are expanding faster than security teams can assess them. Autonomous penetration testing is emerging as a critical discipline, as AI-powered attackers compress the time from vulnerability discovery to exploitation from months to hours.
Mid-market companies - those most likely to lack dedicated security headcount - are caught in the crossfire, according to Chris Wallis, co-founder and CEO of Intruder Systems Ltd. But AI pen testing is now presenting opportunities for defenders that traditional scanners never could.
“The AI can start to understand your whole attack surface and start to reason about it in ways that previously would’ve taken a human to do,” Wallis said. “What AI is really doing now is closing that gap between what a pen test is and what scanners have been able to do in the past.”
Intelligent digital workers widen the exposure gap
The threat landscape has shifted dramatically as both attackers and defenders adopt AI. More departments now deploy their own agents and AI-coded applications, creating new exposure vectors that traditional scanners cannot evaluate. Intruder’s response is its new AI Pentesting offering, which uses AI agents to actively investigate scanner findings and determine whether they represent genuine, exploitable risks.
Intruder’s own research found that 42% of mid-market security teams describe themselves as stretched, overwhelmed, or consistently behind. The AI agents run on Intruder’s infrastructure - requiring no customer deployment - and reduce investigation work that previously took hours down to minutes.
Looking ahead, the boundaries between scanning, penetration testing and red-teaming are dissolving into a unified exposure management workflow. AI won’t replace human pen testers, but will amplify them, Wallis said. “What this technology is helping us to do is to democratize that and make pen testing available to more and more companies who either wouldn’t have had the budget at all, or would have just done it once a year, and now they have access to it on demand.”