Intruder survey finds 47% of firms go over a month between pentests of their most-tested app
Intruder's survey of 500 US and UK security and engineering leaders finds 47% go over a month between full pentests while 68% ship to production at least daily. Only 4% say their testing frequency gives sufficient coverage, according to findings Intruder published on its own site.
The Watch · Security desk
Key figures from Intruder's survey: 68% of organizations deploy code to production at least daily; 42% accept the risk and ship code without additional security checks between pentests; 4% of security leaders believe their current testing frequency gives them sufficient coverage.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Organizations deploying to production at least daily | 68% | 1 | |
| Ship code without extra security checks between pentests | 42% | they accept the risk, Intruder says | 4 |
| Leaders who say testing frequency gives enough coverage | 4% | security leaders, on current frequency | 3 |
What happened
- 42% of organizations accept the risk and ship code with no additional security checks between pentests.
- 88% of leaders running scheduled pentests worry about unmapped risk introduced between tests.
- 55% of organizations use AI pentesting across their environment, another 36% have tried it, and fewer than 1% have no plans to.
- The top barriers to AI pentesting are data privacy at 40% and safety on production systems at 36%; only a quarter named quality doubts.
- 56% of teams spend six hours or more a week validating findings from their security tooling.
Why it matters
- Who's exposed exposure A flaw introduced in one release can sit for weeks or months before a pentest reaches it, and the monthly-plus figure covers only each firm's most-tested application.
- What doesn't add up contradiction 91% of respondents use or have tried AI pentesting, yet long gaps between full pentests remain common, so adoption alone has not closed the gap in these results.
- What it limits constraint Vendors face a proof requirement: nearly half of leaders say not seeing what was tested, or lacking proof a finding is real, would damage trust most.
Leaders do not agree on how bad the gap is. Of the worried leaders, half call it one of their largest unmanaged cyber risks, and the other half call it a known gap they cover with basic perimeter controls [6]. The stopgaps are varied: automated scanning in the build pipeline, more frequent manual pentests, internal AppSec teams and AI pentesting are each used by around half [12].
Intruder's case for AI pentesting runs through cost and speed. It says a human-led pentest at the pace of shipping has never been realistic, largely because of the cost [16]. It says time-to-exploit is now down to a single day [15]. AI pentesting, in its telling, lets teams run in-depth tests whenever they need them instead of waiting for the next scheduled one [17].
We think the survey supports the diagnosis and leaves the remedy untested. The summary does not break test frequency out by AI pentesting use, so it cannot show that adoption narrows the gap.
Validation and retesting are where time goes once a finding exists. For one in five teams, validating findings from security tooling takes more than a full working day, and Intruder calls it the biggest bottleneck in remediation [8]. Less than two in five organizations check a fix again right after it ships, and close to half wait as long as two weeks to do it [10].
What to watch
- Intruder's full report, which the summary says breaks down adoption by country and sector. A cut of pentest frequency among AI pentesting users would test the remedy the summary proposes.
- Vendor answers on data handling and production safety, the two barriers leaders name most often at 40% and 36%.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption55
- Hype gap+35
- Incentives75
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
68% of organizations deploy code to production at least daily, and 37% deploy multiple times a day.
- [2]
47% of organizations go more than a month between full pentests on their web applications and APIs; that is for each organization's most frequently tested application, so the rest of the estate is tested less often still.
- [3]
Only 4% of security leaders believe their current testing frequency gives them sufficient coverage.
- [4]
42% of organizations accept the risk and ship code without additional security checks between pentests.
- [5]
88% of leaders running scheduled pentests are worried about unmapped risk introduced between tests.
- [6]
The worried leaders split almost evenly: half call the gap one of their largest unmanaged cyber risks, while the other half describe it as a known gap they are covering with basic perimeter controls.
- [7]
The biggest barriers to AI pentesting were data privacy (40%) and safety on production systems (36%); doubts about quality were named by only a quarter.
- [8]
56% of teams spend six hours or more a week validating findings from their security tooling, and for one in five it is more than a full working day; Intruder calls it the biggest bottleneck in remediation.
- [9]
Nearly half of leaders said that not seeing what was tested, or not getting proof that a finding is real, would damage their trust the most.
- [10]
Fewer than two in five organizations retest a fix as soon as it ships, and nearly half take up to two weeks.
- [11]
For The State of AI Pentesting 2026, Intruder surveyed 500 security and engineering leaders across the US and UK.
- [12]
Automated scanning in the build pipeline, more frequent manual pentests, internal AppSec teams, and AI-driven pentesting are each used by around half of teams to cover the gap between pentests.
- [13]
55% of organizations already use AI pentesting across their environment, a further 36% have tried it but not adopted it at scale, and fewer than 1% have no plans to try it.
- [14]
91% of surveyed organizations have either adopted AI pentesting across their environment or tried it.
- [15]
Time-to-exploit is now down to a single day.
- [16]
Running a human-led pentest as often as code ships has never been realistic, largely because of the cost.
- [17]
AI pentesting has emerged as a way to run in-depth tests whenever teams need them, instead of waiting for the next scheduled pentest.
- [18]
A vulnerability introduced in one release can go weeks or months without a pentest.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- What 500 security leaders think about AI pentesting
intruder.io
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Vendor-run surveysFollow
- Application SecurityFollow
- AI penetration testingFollow
- Penetration Testing and Assessment PracticeFollow
Entities
- IntruderFollow