58% of organizations utilize pentesting-as-a-service (PTaaS) for continuous testing.

53% of organizations say point-in-time penetration testing becomes outdated before results can be acted upon.

58% of professional pentesters rank PTaaS as the most effective model for uncovering complex vulnerabilities.

98% of professional pen testers prefer the PTaaS model over bug bounties.

15% of professional pentesters rank public bug bounties as the most effective model for uncovering complex vulnerabilities.

1% of professional pentesters believe AI-only scanning is effective for uncovering high-impact, exploitable vulnerabilities.

64% of organizations prefer an agent-led, human-oversight model combining machine scalability with a human safety net.

87% of organizations have moved beyond evaluation and are actively planning, piloting, or using agentic AI for penetration testing.

Organizations test only 32% of their global attack surface on average.

95% of organizations rank penetration testing as a top priority.

68% of the enterprise environment remains untested, creating significant blind spots.

49% of organizations expect complete or significant displacement of traditional penetration testing services by agentic AI.

95% of organizations anticipate that agentic AI will displace traditional penetration testing services.

54% of professional pentesters report having discovered a Zero-Day or N-Day vulnerability that had no existing public patch or advisory.

51% of professional pentesters cite the pressure to be the first to submit a finding as their primary frustration with bug bounty programs.

32% of SMBs perform penetration testing.

Approximately 40% of financial firms have increased their penetration testing frequency to quarterly or continuous testing.

18% of SMBs have deployed penetration testing.