[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0YipHrS5YzvSZ37VGuf14PtKjPXydR8AIaKuS-ngw1E":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e18fd048-8aac-4731-8a7f-549c1d3315e9","CISO's Expert Guide to Agentic Pentesting for Websites","ciso-s-expert-guide-to-agentic-pentesting-for-websites-3cc3e4","Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one at production. TL;DR Exploitation is now the front door. It starts 31% of breaches (Verizon DBIR","A new guide highlights the growing gap between vulnerability exploitation and patching times, suggesting autonomous AI agents can help. Attackers now weaponize new vulnerabilities in about five days, while organizations take a median of 43 days to patch them. The guide emphasizes the need for security leaders to demand specific capabilities from AI pentesting tools before deploying them in production environments.","New guide explores how autonomous AI agents can improve website pentesting speed.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisos-expert-guide-to-agentic.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhqOqtV_80Gn3utPVzonjyU94CgrwrcRNCUvdMEMZbOJGmKGOGD_ly8yH-V5AVwUtyNADgEPXySLFga7FZiWBSHCESverdknL-LS6MJSrkv6ejTaFkDM087mWkfBfur7UQ_vXsM8gcBByxyYyn0g3rAENhqJamGszCkPf2LM31d3wDgEUpCuFrGt4mZnUE\u002Fs1600\u002FREFF.jpg","2026-09-17T10:50:53+00:00","2026-09-17T14:00:31.704827+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Google Cloud","product",{"name":21,"type":22},"Mandiant","vendor",{"name":24,"type":22},"Verizon",{"name":26,"type":19},"Cobalt",{"name":28,"type":19},"HackerOne",{"name":30,"type":19},"IBM","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[21,24,18],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":86,"name":87,"problem":88,"products":89},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"intigriti","Intigriti","\u002Fvendor-logos\u002Fintigriti.png","intigriti-bug-bounty","Intigriti Bug Bounty","https:\u002F\u002Fwww.intigriti.com\u002F","Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"slug":115,"name":116,"problem":117,"products":118},"patch-management","Automated patch management","Known holes get closed in days, not months.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[144],{"slug":145,"name":146,"logo_path":147,"roles":148},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":163},"attackers-exploit-vulnerabilities-8x-faster-than-organizations-can-patch","Attackers Exploit Vulnerabilities 8x Faster Than Organizations Can Patch","The widening gap between vulnerability weaponization (5 days) and organizational patching (43 days median) creates a dangerous window of exposure that attackers are actively exploiting. This asymmetry means reactive, manual security processes are structurally unable to keep pace with the modern threat landscape. The emergence of agentic AI pentesting tools offers a potential equalizer, but only if security leaders evaluate and deploy them with clearly defined capability requirements. Without closing this remediation gap, even well-resourced organizations remain chronically exposed to known, patchable threats.",[155,156,157,158,159,160,161,162],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning","NIST CSF ID.RA-1 – Asset Vulnerabilities Identified and Documented","NIST CSF RS.MI-3 – Newly Identified Vulnerabilities Mitigated","NIST SP 800-115 – Technical Guide to Information Security Testing","ISO\u002FIEC 27001:2022 – Annex A 8.8 Management of Technical Vulnerabilities","ITIL 4 – Problem Management & Change Enablement Practices",{"CIS Control 12 – Network Infrastructure Management":164,"CIS Control 7 – Continuous Vulnerability Management":165,"ITIL 4 – Problem Management & Change Enablement Practices":166,"NIST CSF RS.MI-3 – Newly Identified Vulnerabilities Mitigated":167,"NIST SP 800-115 – Technical Guide to Information Security Testing":168,"NIST CSF ID.RA-1 – Asset Vulnerabilities Identified and Documented":169,"NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning":170,"ISO\u002FIEC 27001:2022 – Annex A 8.8 Management of Technical Vulnerabilities":171},"Keeping network infrastructure current matters because edge devices are often the vulnerabilities attackers weaponise first.","Continuous vulnerability management with risk-based, faster remediation targets the gap between 5-day weaponisation and 43-day patching.","Change enablement practices can streamline approval for security patches, helping shrink the window of exposure.","Mitigating newly identified vulnerabilities quickly is the specific outcome the slow patching undermines.","Security testing, including automated or AI-assisted testing, helps find exploitable weaknesses before attackers do.","Identifying and documenting asset vulnerabilities is the first step to closing the remediation gap.","Patch management planning helps organisations shorten their 43-day median by prioritising exploited vulnerabilities.","Managing technical vulnerabilities means acting on exposure in time, a challenge when exploitation is eight times faster than patching."]