Jason Haddix: Stop fearing AI pentesting

Jason Haddix on why '90% of pen tests will be done by AI': AI solves pentesting's scale problem, scanners-in-disguise will fade, and defenders must fight AI with AI rather than fear it.

Deel's whole job is making it possible to hire flexibly: whether the people are remote, contractors, or spread across entities and countries you don't personally manage. That flexibility is exactly what makes security hard to keep consistent. Access often outlives the project it was granted for. A package, browser extension or AI skill gets installed on a whim. A new dependency reaches a repo before anyone's reviewed it.

Aikido launches the Aikido Machine: an on-prem server running its AI pentesting and code analysis on local GPUs and local models, for regulated sectors that cannot send code to the cloud.

XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.

An RFP evaluation framework for buying AI application pentesting: separating true autonomous testing from scanners and AI-assisted workflows, with questions, criteria and scoring guidance.

Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.