Picus warns agentic pentesting leaves assets untested

AI agents that run penetration tests can find complicated attack paths, but they also leave blind spots, according to an article by the security vendor Picus Security published by BleepingComputer on 14 October 2026.

Penetration testing is the practice of attacking your own systems to find weaknesses before someone else does. "Agentic" pentesting hands part of that work to AI agents, which chain steps together on their own rather than following a fixed script. Picus says this approach is good at uncovering complex attack paths, meaning the multi-step routes an intruder might take from an initial foothold to a valuable target.

The problem, the company said, is coverage. Safety restrictions and network limitations mean many assets and vulnerabilities are never tested at all. Safety restrictions are the guardrails that stop an agent from taking actions that could break production systems or stray outside an agreed scope. Network limitations refer to the parts of an environment an agent simply cannot reach from where it is running. The result, according to Picus, is a report that looks thorough but covers only the slice of the estate the agent was able and allowed to touch.

That is a familiar gap in security testing, and it matters more as organisations lean on autonomous tooling to replace or supplement periodic manual tests. An untested asset is indistinguishable, on paper, from a clean one.

Picus argues the fix is not to loosen the guardrails but to pair agentic pentesting with two other techniques. The first is exposure validation, which checks whether a known weakness is actually reachable and exploitable in a given environment rather than simply present in a scan result. The second is breach and attack simulation, which replays known attacker behaviour against defences to see whether controls detect and block it. Combining the three, the company said, helps close the gaps that agentic testing alone leaves open.

Readers should note the source. The article is written by Picus Security, which sells exposure validation and breach simulation products, so the recommended remedy aligns with the vendor's own portfolio. The underlying caution still stands on its own terms: an AI agent's findings describe what it was permitted and able to test, not the whole attack surface. Teams adopting agentic pentesting may want to ask their suppliers for an explicit account of which assets were reached, which were skipped, and why, before treating a clean result as assurance.