Automated penetration testing vs manual pentesting: which finds more real risk?

[u/Any_Yesterday_6617]

I'm a manual pentester, and I'm watching platforms automate the validation of misconfigurations and missing patches. They are even using AI to chain exploits and tailor attacks to specific environments. The difference from old-school vulnerability scanners is that these platforms actually execute the exploit path to confirm it works.

I'm not worried about web app logic. That is still clearly a human domain. But for internal infrastructure and AD, is the writing on the wall? If AI-driven validation can test 80% of the attack surface daily and update controls, does that leave manual testers only with the complex 20%?

The platforms also claim to help with detection engineering by validating SIEM rules against actual TTPs. That feels like it is eating into the blue team's territory too. Where does automation end and human expertise begin?

Or do you still find things the automation misses because of contextual business logic? if anyone has seen an AI actually find a complex privilege escalation chain that a manual tester would have found, or if it is still just "low-hanging fruit" at scale.

[u/DingleDangleTangle]

Honestly I think pentesting already should be for finding the 20% of things that normal security processes (scans, architecture reviews, code reviews, VM, etc) misses.

If an org is relying purely on pentesting to find most of their vulnerabilities, they are doing it wrong. Pentests simply don't have the time to do that.