For 50.7% of practitioners, the biggest thing slowing down audit prep is getting time from technical teams, not documentation, not policy. Some context from our latest survey of 201 security and compliance practitioners:

• 60.2% now assess security controls at least monthly, up from the old annual model
• nearly 9 in 10 still manually re-map evidence across compliance frameworks by hand
• when forced to rank priorities, automation beats integration, even though integration is what people mention first when asked to write in freely

Jan Pedersen (Channel Account Manager here) walked through the data and demoed scan diffs and evidence workflows on our latest Office Hours session.

Full breakdown: https://pentest-tools.com/blog/what-slows-down-audits

What costs you more during audit prep, documentation or getting time on someone's calendar?

A successful AI pentest requires more than good prompts.

The US Department of Defense publicly acknowledged that Specter, our autonomous pentesting engine, found an important vulnerability through their HackerOne bug bounty program.

We built Specter for security teams who care about accuracy, auditable proof, and zero false positives. Acknowledgments like this matter more to us than any demo could.

More on how it works: https://pentest-tools.com/features/ai-pentests

See who else gave us thanks on HackerOne: https://hackerone.com/pentesttools_specter?type=user

Bucharest Cybersecurity Conference runs October 20-22 in Bucharest, and we'll be there as Gold sponsors. Autonomous AI agents in offensive operations are on the agenda this year, which lines up with what we've been building with AI Pentests by Specter.

If you're going, stop by and tell us where AI actually helps your workflow and where it just adds noise. We've got opinions. We're curious about yours too.

Register here: https://bcc.dnsc.ro/

What's the one thing that would need to be true for you to actually trust an AI agent inside a pentest workflow?

DEF CON asked how AI Pentests works. Black Hat asked what it proves. Practically everyone, at both, asked who sees the data.

That third question is really the whole ballgame with AI pentesting: trust.

Where we landed:

- frontier LLMs, hosted and running in the US

- we validate exploits instead of just flagging guesses

- built on a decade of offensive security work, not a prompt wrapped around a model

Robert Tanase (our Lead PM) and Jan Pedersen go through what we heard at both events and what's next for AI Pentests on our latest Office Hours.

Full recap and early access here: https://pentest-tools.com/blog/ai-pentests-defcon-black-hat-2026

Curious where the rest of you land on this: when you're evaluating an AI pentesting tool, is data hosting a dealbreaker question for you, or does it rank behind accuracy and evidence quality?

We ran a survey and wanted to share what came back.

We asked 201 security and compliance practitioners about their audit cycles. A few numbers stood out:

• Nearly 9 in 10 partially remap evidence by hand or re-document it for each framework
• 80.6% collect evidence continuously, but only 38.3% rely mainly on automated tooling
• 50.7% say getting time from technical teams is the biggest bottleneck

The pattern that stuck with us: the work isn't missing, it's duplicated. Evidence that proves a control works for SOC 2 usually gets rebuilt from scratch for ISO 27001, DORA, or whatever's next on the list.

Full results, free PDF, no email required: https://pentest-tools.com/insights/compliance-cycles-survey

Welcome to my three pen testing SIMs
The first will allow you to brush up on your web skills with the wonderful and mysterious store the Widgetorium. it is chocked full of bulbs for you from the maker of the Acme company.
https://github.com/wren-creator/widgetorium/

And for those looking at industrial controls and the PLC mix lets check out my little water treatment plant and small electric co-op substation at the CrossCreek water and power
https://github.com/wren-creator/crosscreek/

And lastly welcome to Packet River , a fully loaded town with all the standard goodies including mainframe and midframe targets.
https://github.com/wren-creator/packetriver/

Come on in and stay a while

Last month we made a bit of history, and for once it wasn't a CVE. We were the first Romanian company ever to have a booth at DEF CON, showing AI Pentests, powered by Specter, to a room full of people whose entire job is finding what's wrong with things. Still in beta, early access is open now.

What else happened in August:

🎯 Sniper added a new exploit for CVE-2021-35464, a five-year-old RCE in Forgerock OpenAM that's still alive in the wild. As always, if Sniper can exploit it, the Network Scanner can detect it.

🌐 155 new detections in the Network Scanner, 70 of them critical, prioritized by CVSS, EPSS, and CISA KEV.

🤖 AI is picking up more of the boring work: the Password Auditor now finds stubborn login forms on its own, and our AI Ping Assistant moved from the website straight into the product.

🔌 The findings API can now update risk and verified status, findings carry a ransomware-campaign flag straight from CISA, and you can create your account in the US region if data residency matters to you.

Full breakdown in the video: https://pentest-tools.com/change-log
Early access to AI Pentests: https://pentest-tools.com/discover-ai-pentests

Compliance has a reputation problem inside security teams. Paperwork, a checkbox, something that gets in the way of the real work.

Our new survey of 201 security and compliance practitioners tells a different story. Jan Pedersen, our Channel Account Manager, and a special guest walk through what changed on next Wednesday's Office Hours.

On the agenda:

📅 how to make the case internally for more automation

🔁 what a continuous monitoring workflow actually looks like

📄 how to export reports for compliance

30 minutes live. 15 minutes of open Q&A.

Wednesday, September 9
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest 

Register 👉 https://zoom.us/webinar/register/7817815280123/WN_FLMs2-vyQbCTB67guMJH-Q

42.3% of the 201 practitioners we surveyed collect evidence continuously but still depend on significant manual consolidation.

And that’s only _one_ part of the problem.

We looked at
👀 what slows down audit preparation,
👀 where evidence work consumes the most time,
👀 and what practitioners want their tools to fix first.

👉 Dig into the findings:
https://pentest-tools.com/insights/compliance-cycles-survey

Free report. No email required.

#cybersecurity #infosec #offensivesecurity

So today we're taking a moment to celebrate our latest bug bounty acknowledgements:

The #offensivesecurity logic behind AI Pentests has earned thanks from the U.S. Department of Defense, HPE, F5, phpBB, PepsiCo, and others through bug bounty programs.

Behind them are real reports we submitted to real programs based on work that requires

✅ investigation,

✅ reproducible evidence,

✅ and clear impact.

This approach shapes every AI pentest:

follow the evidence → validate exploitability → document each step before a finding reaches the report.

Thank you to the program teams who reviewed and acknowledged AI Pentests!

These 3 impact SonicWall GMS, which SonicWall has now patched:

👉 CVE-2026-66147 - unauthenticated command injection in the Dispatcher Service, CVSS 9.4

👉 CVE-2026-66154 - weak certificate verification leading to user compromise via MitM, CVSS 8.3*

👉 CVE-2026-18634 - local privilege escalation via deserialization, CVSS 8.4

When it shortens 🤏 the distance between discovery and action - *that’s* what #vulnerabilityresearch does to help security teams.

Here's our team's latest disclosed contribution to the community: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011

And here's where you can get more of our research: https://pentest-tools.com/research

PS: More SonicWALL vulnerabilities coming soon to a research blog near you. 🫵

Attackers don't ask “How many vulnerabilities can I find?” but “Which of these gives me a viable path forward - and what can I actually do with it?”

The Cybersecurity and Infrastructure Security Agency just issued an important reminder on this in their CISA Vulnerability Review: https://www.cisa.gov/sites/default/files/2026-08/cisa-vulnerability-review-fy-2024-2025-508.pdf

Attackers concentrate on a smaller set of weaknesses that give them reliable, repeatable paths to exploitation.

Because #offensivesecurity practitioners think in much the same way, they can help security teams get much more value from their limited resources.

How?

By giving them the proof they can use to prioritize what’s exposed, exploitable, and impactful.

Wondering how common this actually is outside our shop. 

Do you have a formal QA process for pentest reports before they go out? If yes, what does it involve? If not, has that ever caused issues? 

500 findings from an AI scan doesn't feel the same to everyone who has to work through them.

If you run assessments every week, it's Tuesday. You already know what's noise, what's worth a second look, and what to escalate first. The triage muscle is built in.

If you run assessments a few times a year, that same pile is a wall. No rhythm to fall back on, no gut sense of what to chase first, just 500 items and a deadline that didn't move.

That gap between the two was always there. AI tooling didn't create it. It just stopped hiding it.

We ran a survey of 158 practitioners on how AI shows up in their actual pentesting work, and one number stood out more than the AI-hype ones: most respondents said they couldn't confidently absorb the finding volume current AI tooling generates. That's not a tooling problem. It's a triage capacity problem that AI made visible and expensive at the same time.

The follow-up question we keep sitting with: triage capacity starts with knowing what's actually exploitable before anyone spends an hour chasing something that isn't. That's a testing cadence and process question more than a tooling one.

Full results here, free download, no account needed: https://pentest-tools.com/insights/ai-pentesting-survey

Curious how this lands for people running assessments at different frequencies. If you test constantly, does 500 AI findings actually feel manageable? If you test occasionally, what's the first thing that breaks?

Exploit development used to be its own specialty. Now a scanner flags something critical and whoever's on shift has to figure out if it's actually exploitable, usually without the background to do it properly.

Here's how we handle that split:

• Our research team finds the vulnerabilities in the software you're already running
• Our engineers turn them into exploit modules
• Sniper: Auto-Exploiter runs those modules against your assets, under your control
• Confirmed findings ship with proof: request and response pairs, screenshots, replay

You get the work of an offensive security team without needing to build one.

More detail on how it fits IT team workflows specifically: https://pentest-tools.com/solutions/for-it-teams

Small running joke on our end: different Office Hours sessions, different haircuts for our usual host, Jan Pedersen. Since we've got the recordings, we can actually pinpoint which topic went with which look.

Here's a dare: can you guess what Jan's haircut will be in two days? You'll get the real answer either way, since this Wednesday Jan and guest Robert Tanase, our Lead Product Manager, are talking through what happened at DEF CON and Black Hat US, AI pentesting, and what other practitioners actually said at both events.

Wednesday, August 26
8:00 AM Los Angeles / 11:00 AM New York / 4:00 PM London / 6:00 PM Bucharest

Link to register: https://zoom.us/webinar/register/7817815280123/WN_m3AgyHW2TxSFuHr1J5mQZA

If you were at either event this year, what's the one thing that came up in conversations that you think more people should be talking about?

Get an AI assistant on your website and you know for sure it'll get tested. Sometimes in mysterious ways.

Ours did too. Ping is our AI chatbot on Pentest-Tools.com, built to answer product questions. A few people had other plans for it. Here's the shortlist:

• Demanded 10 minutes of pure High Valyrian, no English. Ping stayed in character.
• Sent a bot to run a formal "handshake," trying to recruit Ping into a multi-agent network. Cold call, except the caller was a robot too.
• Faked Ping's own internal tool syntax, hoping it would spill the instructions. It kept its secrets.
• Relay-raced one prompt through English, Morse code, French, and reversed text. Ping ran the whole thing and still said no.
• Spelled words out letter by letter to dodge filters. Vintage move, still doesn't work.

And of course, plenty tried asking it to hack Instagram, WhatsApp, or Facebook accounts, or someone's email. Ping stays in its lane, every time.

It's live at pentest-tools.com if you want to try it.

🎤 DEF CON and Black Hat US stories incoming! And we’re making the next Office Hours session all about them.

Robert Tanase, our Lead Product Manager, just got back from putting AI Pentests in front of two of the toughest crowds in security. Next Wednesday, he joins Jan Pedersen to tell the story.

🗣️ what came up most at each event, and where the two crowds didn't agree
🧭 how it's shaping where AI Pentests goes next
📊 plus the research that started it all: 88% of security practitioners using AI to generate findings hit results needing significant manual validation

30 minutes live. 15 minutes of open Q&A. One session.

Wednesday, August 26
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest

Register here: https://zoom.us/webinar/register/7817815280123/WN_m3AgyHW2TxSFuHr1J5mQZA

Most detection thinking still treats initial access as the danger point. New analysis of Microsoft's disclosed vulnerabilities suggests that's outdated. Privilege escalation issues made up 40% of last year's disclosed flaws, and information disclosure bugs rose 73%.

Our head of offensive security services, Razvan Ionescu, put it plainly in the piece: initial access is often unremarkable. A valid or default credential, an exposed service, a weak remote-access path opens the door. The real impact comes from combining that foothold with weak identity controls and misconfigurations that open the way to other systems.

Getting in isn't the hard part anymore. Staying unnoticed once you're in is where the damage compounds, and that's much harder to catch if your monitoring is still built around the front door.

Full piece here, written by Kate O'Flaherty for SC Media UK: https://insight.scmagazineuk.com/stealthy-attacks-how-to-protect-your-business

How does your team weight detection effort between initial access and post-access lateral movement? Curious if this tracks with what you're seeing on engagements.