An AI sent 1,060 vulnerability reports in 90 days and topped HackerOne. Is pentesting over?

Ninety days, one thousand and sixty reports

In June 2025, XBOW became the first autonomous system to lead the US leaderboard on HackerOne, the world's largest bug bounty platform. In roughly 90 days, the company's pentesting agent sent 1,060 vulnerability reports to programs run by real companies. Fifty-four of them were rated critical.

The market moved fast. XBOW raised $75 million in June 2025 and another $120 million in March 2026, in a round that valued it at more than $1 billion. In August 2026 it was Horizon3.ai's turn. The owner of the NodeZero autonomous pentesting platform raised $250 million at a valuation above $2 billion. The company says it has more than 6,500 client organizations and has run more than 300,000 pentests in production environments.

For anyone who buys security, the question is obvious. If a machine does in 90 days what a team would take years to do, does the human pentest have an expiry date?

My short answer: the pentester doesn't. The annual pentest in PDF form does. The long answer is in the numbers.

What the leaderboard doesn't show

XBOW itself published the breakdown of those 1,060 reports. As of publication, 130 had been resolved and 303 were in triage. Another 208 had been marked as duplicates, 209 as merely informative and 36 as not applicable. The rest were awaiting review.

I ran the numbers. Roughly 4 in 10 reports had already been accepted or were under review, and another 4 in 10 were never going to become a fix. And there is a detail almost no headline mentioned: XBOW's security team reviewed the reports before submitting them, to comply with HackerOne's rule on automated tools.

The machine took the top of the leaderboard. Triage stayed with people.

When AI knows where to look, and when it doesn't

Academic research helps explain the pattern. In April 2024, researchers at the University of Illinois showed, in a study still in preprint and covering only 15 known vulnerabilities, that a GPT-4-based agent exploited 87% of them when given the official description of the flaw. Without the description, 7%. In 2025 the same group published CVE-Bench, with 40 critical flaws in web applications, and the best agent solved at most 13%.

With a map in hand, AI exploits very well. Without one, it still stumbles a lot.

I don't want to downplay what machines already do, because it is a lot. At the final of DARPA's AI Cyber Challenge in August 2025, seven teams analyzed more than 54 million lines of code. The systems found 54 of the 63 flaws planted by the organizers and, on top of that, 18 real vulnerabilities nobody knew about, at an average cost of about $152 per task. Big Sleep, the agent Google's Project Zero built with DeepMind, found an exploitable flaw in SQLite in 2024 before it reached any official release. In July 2025, according to Google, it was used for the first time to stop the exploitation of a flaw that only the attackers knew about.

Finding flaws became fast and cheap. Everything else became expensive.

The money isn't betting on today's pentest

In July, Vicente Conde wrote that SaaS isn't dying, it is changing shape. With agents, software starts charging for outcomes and can capture part of the value that always went to human labor. To illustrate, he cites an Insight Partners slide that shows cybersecurity as a $350 billion market across labor and services, of which software takes $95 billion.

Pentesting may be the clearest example of that thesis. MarketsandMarkets estimates the penetration testing market was worth $1.98 billion in 2025 and projects $4.39 billion for 2031. A company valuation and market revenue are different measures, I know, and I am not adding one to the other. Even so, the comparison says something: investors put a value on a single autonomous pentesting company that exceeds the annual revenue of the entire sector. Nobody does that to compete in the pentest market as it is today. The bet is to replace the "one test a year, one PDF report" model with continuous testing, sold like software.

The detail that should bother defenders

While we debate whether the agent will replace the pentester, the attacker has already chosen. In the report Anthropic published in November 2025, there is an espionage campaign, attributed to a Chinese state-sponsored group, in which AI carried out 80% to 90% of the tactical operations on its own against some 30 organizations.

The same report shows that even the attacker had to check the machine's work. The AI at times claimed it had obtained credentials that did not work, and Anthropic treats this as an obstacle to fully autonomous attacks.

Both sides reached the same conclusion. What differs is frequency: the attacker tests every day, and many companies test once a year.

In Brazil, tools are not what's missing

ISC2 estimated in 2024 that Brazil was short 214,536 security professionals. In the 2025 edition of the study, with more than 16,000 professionals surveyed, the organization stopped calculating the gap and began measuring skills: 59% report a critical or significant skills need, up from 44% a year earlier.

Regulation doesn't require the annual ritual either. Resolução CMN 4.893 (a Brazilian central bank rule), from 2021, asks financial institutions to carry out periodic tests and scans to detect vulnerabilities. Nowhere does it say "annual pentest". It says periodic, which leaves plenty of room for continuous testing.

Three choices from those who already get the shift

1. Swap the event for the flow. The annual pentest takes a snapshot of an environment that changes every week. Continuous, automated testing catches what the snapshot misses, and the specialist steps in where the machine errs most: business logic, chained flaws, context.

2. Buy validation instead of volume. The number that matters isn't how many flaws the report lists. It's how many someone has confirmed are exploitable in your environment, and with what business impact. The XBOW case shows that, even at the top of the leaderboard, much of the volume never becomes a fix.

3. Give the testing agent a scope and an owner. An agent that tests on its own can also leave its scope on its own. A contract, technical limits and a named person in charge need to exist before the first scan, not after the first scare. I return to this accountability problem in the last piece of the series.

The question for the next proposal

When the next pentest proposal arrives, from a consultancy or an autonomous platform, ask one question: of every 100 findings you deliver, how many has someone confirmed are exploitable in my environment, and who signs off on that confirmation?

The AI that reached the top of HackerOne sent 1,060 reports. The work worth paying for was knowing which of them mattered.