The inconvenient truth about AI pentesting: someone has to check all the work

AI pentesting has a ‘Sorcerer’s Apprentice’ problem. Enchant a broom to fetch water, and it will fetch water, relentlessly, long after the workshop has flooded.

The industry is busy measuring how fast AI finds vulnerabilities (we’re looking at you, Anthropic). Far fewer people are costing out who checks all that work. That gap has a name: validation debt, and it’s the backlog of unverified findings that rolls in when discovery scales and verification doesn’t.

In a recent survey, 158 practitioners were asked whether their teams could triage more than 500 AI-generated vulnerability candidates from a single engagement. Only 20.3% said they had a workflow in place to handle it. Another 38.6% said that volume would strain the team, and 29.7% said it was unmanageable.