Confidence in fully automated AI-powered vulnerability testing has collapsed among cybersecurity professionals, according to Cobalt’s 2026 State of Pentesting Report. Only 9% of respondents now trust these tools to find critical flaws — down sharply from 29% just last year.
The report, based on surveys of roughly 450 security professionals, found that 78% had personally witnessed automated tools missing serious vulnerabilities. The issue isn’t that AI scanners find nothing. It’s that what they miss tends to be the stuff that actually matters — complex business logic flaws, context-dependent weaknesses in AI-powered applications, and novel attack chains that require reasoning, not pattern matching.
The consequences show up in the numbers. Mean time to resolve AI and LLM security issues has nearly doubled, climbing from 19 days to 36. Even more concerning, 62% of LLM vulnerabilities remain unresolved at the time of analysis. That’s a growing backlog of known issues sitting in production systems.
The industry’s response has been a decisive pivot toward hybrid testing — combining automation with human expertise. Nearly half of professionals, 47%, now favor this approach. Automation handles high-volume, low-context scanning. Humans tackle the nuanced, complex threats that require judgment and creativity.
Why the sharp drop in trust? Consider what AI attack surfaces actually look like: multi-step prompt chains, context windows spanning thousands of tokens, and dependencies on external data sources. Traditional scanners weren’t designed for this. A tool can flag a potential injection, but understanding how a sequence of model prompts leads to data leakage across a multi-step workflow requires a human who thinks like an attacker.
The bottom line for security teams: automation is a useful assistant, but treating it as a replacement for human testers is a mistake the industry is waking up to — a bit late for some.
