AI pentesting tools are generating more findings than security teams can validate, new survey finds

A survey of 158 security practitioners by Pentest-Tools.com reveals that AI-assisted pentesting tools are creating a validation backlog rather than saving time. 87.8% of respondents said AI-generated findings required significant manual validation, and nearly 30% of free-text frustrations cited false positives, hallucinated exploits, or fabricated CVEs. One practitioner reported 250 of 300 AI-generated findings were junk. Only 20.3% of teams had workflows to handle 500+ findings from a single engagement. AI usage is highest in scanning and report writing but drops sharply in phases requiring live judgment like exploitation and lateral movement. Business logic flaws remain a consistent blind spot for AI tools. Meanwhile, 75.3% of practitioners already test AI-powered or LLM-integrated applications, and stakeholder pressure for more frequent testing is rising. Testing cadence — not org size — emerged as the strongest predictor of a team's ability to cope with AI-generated volume.

Source: https://www.itsecurityguru.org/2026/08/03/ai-pentesting-tools-are-generating-more-findings-than-security-teams-can-validate-new-survey-finds. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.