A photo of last month

A good pentest is valuable work. It also describes one version of your software, and most teams ship a new one before the report is even delivered.

The gap attackers use

Attackers now use AI to run in hours what used to take weeks. Serious breaches rarely need a zero-day. They chain known, low-severity issues that nobody looked at together.

What to do instead

Keep the human pentest for the hard questions. Run an automated attacker on every merge for everything else, and make each fix prove itself with a regression test.