Agentic Pentesting Reaches Only 20-30% Real Coverage in Enterprise, Study Finds

Autonomous penetration testing powered by AI agents can prove individual exploits work and trace chained attack paths through enterprise networks—but a critical gap remains between what agentic tools can validate and what attackers can actually exploit. A technical analysis reveals that agentic pentesting, despite its speed advantages, covers only an estimated 20 to 30 percent of real exploitability in typical large organizations, a finding that challenges the technology's sufficiency as a standalone security validation approach.