A sponsored analysis published by BleepingComputer argues that AI pentesting is not a like-for-like replacement for human engagements, but that the comparison itself may be the wrong frame. Written by Daniel Thatcher, a security research engineer at Intruder, the piece draws on his twelve years of penetration testing experience to map out where the company’s agents outperform human testers, where they fall short, and where the distinction stops mattering.
Intruder launched the capability in April 2026, alongside its existing vulnerability scanning and attack surface management platform. The product takes a white-box approach: agents work through the full source code of a connected repository rather than probing from the outside.
Methodology versus instinct
Thatcher’s central argument is that the value of a human pentest was never in its checklist. Strict methodologies, he writes, give clients the impression of a repeatable, comprehensive process, but the most impactful findings typically come from testers following unusual behaviour rather than ticking boxes. Early experiments at Intruder with rigidly structured agents, each assigned a specific vulnerability class, produced agents that missed anything outside their remit or miscategorised findings to fit their brief.
The approach Intruder settled on gives agents broadly defined roles and freedom to explore, with tighter guardrails only to prevent out-of-scope disruption. Thatcher cites a concrete result: a complex authentication bypass that had gone undetected across five years of human pentests was identified by the agents. His reasoning is that no testing guide could have been written to find it systematically, the kind of issue that falls outside any checklist almost by definition.
The agents also build a contextual model of what an application is supposed to do. Because they read the entire codebase, they can infer, for instance, that low-privileged users should not reach admin functions, without being told explicitly. Thatcher notes that clients can supply additional context (flagging concerns about customer data isolation, for example) and the agents will concentrate effort there, much as a human tester would after a scoping call.
Where the agents fall short
Thatcher is candid about the gaps. Agents cannot ask follow-up questions mid-engagement: if a code path is ambiguous, a human tester can phone their contact; the AI cannot. Intruder has had to make its agents deliberately cautious to avoid straying out of scope as a result.
Coverage is also not guaranteed. The freedom that lets agents find a novel auth bypass also makes their path through an application less predictable, and Thatcher acknowledges that consistent coverage ‘is something we’re actively working to improve.’ He draws a parallel with human testing: different consultants find different things on the same application, which is why many firms rotate testers annually. Every human pentest report carries a disclaimer to that effect, he notes, even if clients treat it as a formality.
Risk scoring is another acknowledged weakness. Agents tend to rate issues higher than Thatcher would, partly because they cannot have the contextual conversations that would bring a rating down. He describes this as ‘the right direction to be wrong in’ while noting the team is working on it.
Where the agents do excel, he argues, is remediation guidance. With full source-code access and no time pressure, they can identify the specific line to change and explain what to change it to, rather than producing the generic advice that can emerge at the end of a long engagement. Thatcher points to a customer who resolved 78 flagged issues within a few days, an outcome he says he has never seen from a human pentest cycle.
On cost, Thatcher states that a single human engagement budget can fund roughly four agent-based pentests, making regular deep testing more practical than the typical annual cadence. According to Intruder’s own Security Middle Child Report, cited in the company’s April 2026 launch announcement, 49% of security leaders name AI and automation as their top investment priority for 2026.
Thatcher’s conclusion is that treating agent-based and human pentesting as a ranked contest misses the point. The agents are finding serious vulnerabilities in applications that human testers have already reviewed multiple times; they are also less able to adapt mid-engagement when context is missing. Intruder says it continues to work on coverage consistency and risk calibration as active development priorities.
