Infosec professionals sour on automated pentesting tools

Cobalt’s 2026 State of Pentesting report says automated pentesting is underperforming: 78% of survey respondents experienced “critical false negatives,” and only 9% consider fully automated scanning (down from 29% a year earlier). The report highlights that AI/LLM environments show a higher share of high/critical vulnerabilities (32% vs ~12% in traditional environments) and argues for hybrid testing (AI scans plus human oversight for critical systems). Amazon’s security chief adds that AI pentesting improved security-team efficiency by 40% but still requires a human in the loop for reliable decision-making.

Analysis

The investment signal is less about “AI security failed” and more about pricing power shifting from automation promises to assurance. Buyers are not paying for scan volume; they’re paying to reduce false negatives on novel attack paths, which favors vendors that can layer human review, workflow, and governance on top of tooling. That is structurally negative for low-end autonomous security vendors and for any cybersecurity name whose AI pitch is pure labor replacement.

Near term, I would not expect a sector-wide de-rating: the sample is small and the sponsor has an obvious incentive to frame the market its way. Over 1-3 months, the real test is earnings language from vulnerability-management and appsec vendors—if they start emphasizing “human-in-the-loop” and outcome-based pricing, that’s a tell that buyers are pushing back on fully automated tools. Over 6-18 months, the more important effect is budget expansion: AI is increasing the severity mix of flaws, so security spend should rise, but the mix should tilt toward higher-touch managed services and platform vendors rather than standalone scanners.

The contrarian mistake is to read this as bearish for cyber spending broadly. The more likely outcome is that AI security becomes a services attach-rate story, not a product-story death sentence. That is modestly supportive for larger platforms with broad distribution and for cloud providers that can bundle security into the stack; it is much less supportive for smaller vendors whose valuation depends on the market believing autonomy alone is a durable moat.

Key Decisions for Investors

• Long PANW / short RPD for 1-3 months: express the view that platform vendors with human-in-the-loop workflows take share as buyers get skeptical of autonomous scanners. Target 8-12% relative outperformance; stop if RPD shows accelerating bookings or PANW guide-downs.
• Use CIBR weakness to add exposure, not chase strength: this is more likely a budget reallocation toward cyber assurance than a demand shock. Best entry is on any 3-5% sector selloff; thesis breaks if cyber budget commentary softens across multiple 1Q/2Q prints.
• No immediate trade in AMZN from this print, but monitor AWS security product commentary and internal efficiency claims. The upside is operational, not multiple-expanding; invalidation would be any evidence that AWS security attach is slowing or that human review costs are rising faster than efficiency gains.