By Shira Ozeren Hachoglu, Security Research Engineer at Picus Security.

Agentic Penetration Testing Has Blind Spots: How to Verify Every CVE and Asset

For years, security teams had a grace period of several weeks between the publication of a CVE and its exploitation by attackers. That window has continued to shrink. With Mythos-class models, attackers can now weaponize new CVEs within hours, leaving defenders very little time to determine whether their environments are exposed.

That is where continuous security testing becomes essential. Traditionally, penetration testing happened on a fixed schedule. As the threat landscape accelerated, annual penetration tests became quarterly exercises, while automated penetration testing made weekly testing possible.

Each advancement reduced the amount of time that security changes could remain untested. Traditional automated penetration testing worked well when attackers needed weeks to develop exploits. Now that attackers are moving faster, offensive security testing must evolve as well.

That evolution is agentic penetration testing. It is one of the most advanced approaches to offensive security testing, but it also has important limitations. This article explains how agentic penetration testing works, where its blind spots are, and how security teams can close them.

How agentic penetration testing works

Manual penetration testing typically follows several phases: reconnaissance, vulnerability assessment, initial access, post-exploitation, and reporting. Traditional automated penetration testing tools follow a similar process. Even before large language models became popular, some advanced tools used machine learning to select the next step. For example, Attack Path Verification (APV) products used decision-making engines several years ago.

AI agents take this approach further. In agentic penetration testing, one or more AI agents perform a penetration test step by step, evaluating the results and the organization’s context before dynamically selecting what to do next.

Among the agentic penetration testing products available today, Picus Swarm uses five professional agents coordinated by Numi AI.

An AI penetration testing agent evaluates test results alongside the organization’s environment and risk context. Its ability to adapt can help uncover exploit chains that human testers might miss, and it can do so much faster than a conventional manual test.

However, creativity comes at a cost.

Running a fully agentic process requires significant token usage, and results can vary from one run to another. Even when nothing changes in the environment, an agent might fail to exploit a vulnerability five times and succeed on the sixth attempt. Running dozens of tests reliably can be expensive, and in large organizations with thousands of endpoints, a single agentic test may take weeks.

That is why deterministic automated penetration testing is still necessary. It is less creative, but it provides consistent coverage, costs less, completes faster, and can run more frequently. Because it follows repeatable steps, security teams can compare results over time and retest fixes with greater confidence.

The most effective approach combines both methods. Run deterministic tests frequently to provide predictable coverage, and schedule agentic testing at appropriate intervals. The right frequency depends on an organization’s requirements and risk appetite. Picus Autonomous Penetration Testing supports both fully agentic and deterministic modes and adapts to changing context, risk, threats, and environments.

Agentic penetration testing is valuable, and the need for it is real. However, security teams should understand its limitations before relying on it as their only validation method.

The Achilles’ heel of agentic penetration testing: unreachable assets and untestable vulnerabilities

The greatest strength of agentic penetration testing is also one of its central limitations: it tests by carrying out a real attack. That means it can only test as far as it can safely reach.

Omdia research found that organizations conduct penetration testing across, on average, only 32% of their attack surface.

Safety restrictions prevent testing against some critical systems. Actual exploitation could crash services, corrupt data, or trigger failovers. PCI and NIST guidance therefore advises testers to avoid potentially destructive exploits on vulnerable production systems.

Reachability creates another limitation. An agent can test only systems for which a network path exists. It cannot directly access segmented or air-gapped zones that are outside its permitted reach.

This limitation appeared in one customer environment. A vulnerability scanner identified an nginx-ui authentication bypass, CVE-2026-33032, on 480 instances.

Within the permitted scope of the agentic penetration test, only 120 instances could be tested. Of those, 80 were confirmed to be exploitable and 40 were blocked. The remaining 360 instances—three out of every four affected systems—were unreachable and could not be adjudicated.

The nginx-ui example demonstrates one gap: assets that agentic penetration testing cannot safely reach. A second gap appears when security teams examine every CVE in their environments.

Even when an asset is reachable, many vulnerabilities cannot be tested because there is no exploit available to run. According to VulnCheck, only about a quarter of CVEs in 2025 had proof-of-concept code or exploit details. VulnCheck also reported that 29% of vulnerabilities confirmed to be exploited in 2025 had been exploited on or before their publication date.

Because public exploits are unavailable for many vulnerabilities, some teams use large language models to create them. However, untested exploits can crash services or corrupt data.

This leaves agentic penetration testing with two significant blind spots:

• Assets that the agent cannot safely reach, such as the 360 inaccessible nginx-ui instances.
• Vulnerabilities on reachable assets that cannot be tested because no safe exploit is available.

For more technical details, download the whitepaper.

How exploitability validation covers more assets and exposures

In the nginx-ui authentication bypass example, 360 of the 480 affected instances did not respond when the agent attempted penetration testing. Picus Exposure Validation takes a different approach. Instead of attempting to reach every asset through exploitation, it decomposes a CVE into the attacker behaviors required for exploitation and tests each behavior against real-world security controls.

The resulting verdict is based on evidence that security controls can block the relevant attacker behaviors, rather than on whether an exploit succeeded. Therefore, the absence of a proof of concept is not treated as evidence that an asset is safe.

This approach addresses both blind spots. When combined with asset context, the evidence provides a verdict for the 360 instances that agentic penetration testing could not reach. Of those systems, 260 were blocked by security controls and 100 were considered potentially exploitable.

The 480 raw findings were reduced to 180 evidence-backed priorities:

• 80 instances were confirmed to be exploitable through agentic penetration testing.
• 100 instances were rated as likely to be exploitable through exposure validation.

Security teams can then identify which hosts are already protected by controls and which require compensating controls immediately.

Verify CVEs and assets in hours with three methods working together

Running agentic penetration testing, exposure validation, and breach and attack simulation as separate tools can create siloed or duplicate results, as well as conflicting priorities. These methods should instead use one backlog and one result for each publication, feeding a shared, evidence-backed, context-aware model.

Built on that principle, the Picus platform combines autonomous penetration testing, exposure validation, and breach and attack simulation using shared evidence.

When a critical CVE is published, Numi AI identifies it as a signal and coordinates the next steps through Picus Swarm agents:

• Discovery. CVEs are enriched with threat intelligence and mapped to attacker techniques. Affected assets, business criticality, and existing security controls are identified.

• Verification. Autonomous penetration testing tests assets within scope, breach and attack simulation tests security controls, and exposure validation evaluates all affected assets.

• Mobilization. Low-risk mitigations are deployed automatically. Remaining issues are assigned to the appropriate owner, and all modifications are revalidated.

The entire cycle runs in hours instead of weeks.

Conclusion: Combine agentic testing with deterministic validation

Attackers using Mythos-class models can now weaponize new CVEs within hours. Agentic penetration testing is a powerful way to test security controls like a real attacker. When the same platform also supports deterministic testing, security teams can combine creative discovery with repeatable verification.

However, agentic and deterministic penetration testing can validate only what they can safely and practically reach. Exposure validation helps address the remaining gaps. Together with breach and attack simulation, these three capabilities can work as one platform to validate CVEs across assets in hours.

Want to see it live? Request a free demo today to learn how the process works step by step.

Sponsored and written by Picus Security.