Attackers now weaponize new vulnerabilities in about five days, according to Mandiant, part of Google Cloud. The median organization takes 43 days to patch one, per Verizon's DBIR 2026. A new free guide from The Hacker News explains how autonomous AI agents aim to close that gap, and what security leaders should demand before pointing one at production.

Exploitation now starts 31% of breaches, making it the top initial-access vector, while annual pentesting leaves an estimated 90% of the estate untested. The guide argues the capability is proven: an autonomous system topped HackerOne's US leaderboard in 2025, and peer-reviewed agents exploited 87% of one-day flaws unaided. It also cites Cobalt's 2026 finding that programmatic testing makes teams 4.5x more likely to fix criticals within three days.

The guide outlines three design choices that separate platforms from demos: work-item-enforced coverage, so the AI adapts how it attacks but never whether it tests an item; an independent validator agent that reproduces findings before they reach the report; and a browser-native agent that can handle dynamic rendering, one-time passcodes, MFA and anti-bot defenses.

It also covers governance requirements before a first authorized run, including explicit and revocable scoping, blast-radius guardrails with an immediate safe-stop, data isolation, an exportable audit trail and defined human oversight. On cost, the guide compares a roughly $18.3K manual engagement against a $4.44M average breach, and notes continuous testing produces evidence for PCI DSS 4.0.1 change clauses and other frameworks.

Source: The Hackers News