Modern cybersecurity relies on Breach and Attack Simulation (BAS) and automated penetration testing to continuously verify infrastructure defenses. Unlike manual pentesting, which is infrequent, these tools allow for ongoing assessment of security controls against simulated attacker techniques and full attack chains.
Global BAS platforms include Cymulate, SafeBreach, AttackIQ, and Picus. In the automated pentesting segment, notable solutions include Pentera, Horizon3.ai NodeZero, and the Russian product PT Dephaze by Positive Technologies. The latter was announced in October 2024, with its 3.0 version released in October 2025.
AI-driven systems are increasingly outperforming humans in vulnerability research. In 2025, the XBOW system surpassed human bug hunters on HackerOne, completing tasks 85 times faster than an experienced professional. Meanwhile, Google's Big Sleep project identified a critical memory vulnerability in SQLite, CVE-2025-6965, preventing its exploitation.
Gartner has begun consolidating these technologies into the Automated Exposure Validation category as of 2026. These tools do not replace vulnerability management but serve to validate its effectiveness by identifying attack paths and testing the responsiveness of security systems like SIEM and EDR.
