[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLlPMAjKxDoakpcZ0-RCltXa1vgJrgmhizJ0QbGrixIw":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":99},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"6cb931bb-5c8c-41d2-ab58-c7b4cc1e61cc","Picus puts AI agents on the offensive with autonomous pentesting","picus-puts-ai-agents-on-the-offensive-with-autonomous-pentesting-669430","Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override. The launch rebuilds Picus’s automated penetration testing for the agentic era on five years of enterprise deployments and thousands of automated pentests. In the post-Mythos era, AI models find and … More → The post Picus puts AI agents on the offensive with autonomous pentesting appeared first on Help Net Security.","Picus Security has introduced Picus Autonomous Penetration Testing, an AI-driven capability that uses agents to simulate attacker behavior and chain exploits against an organization's critical assets. This new offering rebuilds their automated pentesting solution for the agentic era, leveraging five years of enterprise deployments and thousands of automated pentests. The system operates under predefined governance rules that agents cannot override, ensuring it stays within approved scope and techniques, with hard-deny rules to prevent destructive actions.","Picus Security launches autonomous pentesting with AI agents.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fpicus-autonomous-penetration-testing\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002F28150559\u002Fhns-large_logo.webp","2026-11-12T15:05:02+00:00","2026-11-12T16:00:15.169205+00:00",7,[17,20,23,26],{"name":18,"type":19},"Picus Autonomous Penetration Testing","product",{"name":21,"type":22},"Picus Security","vendor",{"name":24,"type":25},"AI agents","technology",{"name":27,"type":25},"Active Directory","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":28,"icon":30,"name":31,"slug":32},null,"Tools","tools",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":49,"vendors":98},[50,79],{"slug":51,"name":52,"problem":53,"products":54},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"yeswehack","YesWeHack","\u002Fvendor-logos\u002Fyeswehack.png","yeswehack-bug-bounty","YesWeHack Bug Bounty","https:\u002F\u002Fwww.yeswehack.com\u002F","Bug bounty, vulnerability disclosure and pentest management.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"intigriti","Intigriti","\u002Fvendor-logos\u002Fintigriti.png","intigriti-bug-bounty","Intigriti Bug Bounty","https:\u002F\u002Fwww.intigriti.com\u002F","Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"slug":80,"name":81,"problem":82,"products":83},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",[84,92,97],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"attackiq","AttackIQ","\u002Fvendor-logos\u002Fattackiq.png","attackiq-ready","AttackIQ Ready","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fready\u002F","Managed service that runs MITRE ATT&CK based emulations for you, with no scripting or tuning on your side.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":93,"product_name":94,"url":95,"description":96},"attackiq-enterprise","AttackIQ Enterprise","https:\u002F\u002Fwww.attackiq.com\u002Fproducts\u002Fenterprise\u002F","Continuous, automated adversary emulation across the environment, with full control over scenarios and schedules.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},[],{"slug":100,"title":101,"body":102,"framework_refs":103,"framework_notes":109},"ai-driven-autonomous-pentesting-enters-the-enterprise-security-toolkit","AI-Driven Autonomous Pentesting Enters the Enterprise Security Toolkit","Picus Security's launch of autonomous AI-powered penetration testing reflects a broader industry recognition that traditional, infrequent manual pentests leave dangerous windows of exposure between assessments. Organizations often discover vulnerabilities only after attackers have already exploited them, because human-led pentests are costly, slow, and rarely continuous. AI agents that simulate real attacker behavior and chain exploits can dramatically compress the time between vulnerability introduction and detection. However, deploying such tools without strict governance boundaries — scope controls, hard-deny rules, and audit trails — introduces operational and legal risks of its own. This development underscores the need for organizations to mature their vulnerability management programs toward continuous, automated validation rather than point-in-time assessments.",[104,105,106,107,108],"CIS Control 18: Penetration Testing (v8)","NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded","NIS2 Article 21(2)(f)","NIST SP 800-53 CA-8: Penetration Testing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(f)":110,"CIS Control 18: Penetration Testing (v8)":111,"NIST SP 800-53 CA-8: Penetration Testing":112,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":113,"NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded":114},"NIS2 Article 21(2)(f) requires organizations to assess the effectiveness of their cybersecurity measures, and continuous automated pentesting is a primary mechanism for validating whether defensive controls actually hold up against realistic attack chains.","CIS Control 18 specifically requires organizations to conduct regular penetration tests to identify exploitable vulnerabilities, which is precisely the gap that continuous autonomous pentesting addresses by moving beyond infrequent manual assessments.","NIST SP 800-53 CA-8 mandates penetration testing as part of the security assessment process, and this article's subject directly extends that control into an automated, continuous model that can operate at enterprise scale.","ISO\u002FIEC 27001:2022 A.8.8 requires timely identification and remediation of technical vulnerabilities, and autonomous pentesting provides the continuous validation needed to ensure vulnerability management efforts are actually closing exploitable exposure.","This category requires ongoing identification and validation of asset vulnerabilities, which autonomous AI pentesting directly supports by continuously probing for exploitable weaknesses rather than relying on periodic snapshots."]