Survey says annual pentest obsolete amid rapid code releases

Intruder has published a survey finding that 90% of security and engineering leaders consider the annual penetration test obsolete. The study covered 500 decision-makers in the US and UK.

The report says software release cycles have outpaced traditional security testing. Some 68% of organisations deploy code at least once a day, and 37% do so multiple times a day. By contrast, 47% go more than a month between full penetration tests on web applications and APIs, while just 1% test on every major release.

That gap leaves many teams knowingly exposed. Among organisations that rely on scheduled pentests, 88% said they worry about risks introduced between tests. Even so, 42% still ship code without extra security checks before the next formal review.

The findings also point to pressure on security teams as development speeds rise. More than half of respondents, or 56%, said they spend six hours or more a week triaging, validating or dismissing false positives and findings that cannot be exploited. One in five said they spend 11 hours or more on that work, longer than a standard working day.

Retesting after fixes also appears slow in many organisations. Fewer than two in five said they independently retest a fix in production as soon as it is released, while nearly half said that process can take up to two weeks.

Use of AI-based testing tools is already widespread, according to the survey. Some 92% of organisations have either tried or adopted AI pentesting, and 55% use it across their environment.

Concerns about those tools appear to centre less on test quality than on operational and governance issues. Only 25% of respondents cited the depth of AI testing compared with human testers as a leading barrier. More pointed to data privacy, at 40%, safety on production systems, at 36%, and whether auditors and regulators will accept AI-generated reports, at 28%.

Visibility was another recurring concern. Nearly half of respondents, or 46%, said the biggest factor that would damage trust in AI pentesting would be a lack of visibility into what had been tested or a lack of reproducible proof that a flaw could be exploited.

Chris Wallis, Chief Executive Officer and Founder of Intruder, said the shift in software development and cyber risk had changed the assumptions behind periodic testing. "AI has permanently altered both the volume of code going into production and the speed at which attackers can exploit flaws," he said.

"To close the exposure gap, security validation must become as continuous and automated as the pipelines building the code. The annual pentest may be dead, but the need for continuous validation has never been more real."

Midmarket strain

The survey suggests mid-sized organisations may be under the greatest strain. Businesses with 1,000 to 4,999 employees were described as deploying software as often as the largest companies, but often with smaller security teams.

This group was also the least likely to carry out penetration testing at least monthly, with 47% doing so. Half said they accept the risk and release code without additional checks between formal tests.

Adoption of AI pentesting in that segment appears mixed. Midmarket organisations have tried AI pentesting at the same rate as the largest companies, but only 54% use it across their environment, compared with 71% of organisations with 5,000 to 10,000 employees. Just 4% of midmarket respondents said they faced no major barriers to adoption.

Definitions differ

The research also highlighted confusion over what "continuous pentesting" means in practice. While 96% of organisations described it as a priority and more than a third said they had achieved it, no single definition offered in the survey was selected by more than 35% of respondents.

That matters because companies may be using the same term to describe different levels of test coverage and frequency. In practice, a claim of continuous testing may range from regular automated checks to broader validation across releases and production systems.

The survey also found geographical and sector differences. In the US, 64% of organisations said they use AI pentesting across their environment, compared with 42% in the UK. Professional services and financial services led by sector at 64% and 63% respectively, while manufacturing trailed at 39%.

Financial services firms also stood out for release speed, with 46% deploying code multiple times a day. That combination of rapid release cycles and heavier adoption of AI testing tools suggests some sectors are moving faster than others to adapt security processes to modern software development practices.

According to the methodology, the study was conducted independently by Censuswide and surveyed 500 security and engineering decision-makers, including Chief Technology Officers, Chief Information Security Officers, Vice Presidents of Engineering and DevSecOps Leads, across companies with 250 to 10,000 employees.