95% of Enterprises Prioritize Pentesting, Yet Only 32% of Attack Surfaces Are Tested, New Synack and Omdia Research Finds

A recently published report titled “The 2026 State of Agentic AI in Pentesting,” jointly released by cybersecurity firm Synack and research company Omdia, reveals a significant discrepancy between enterprises’ security priorities and their actual penetration testing coverage. The study surveyed 200 U.S. security leaders and found that while 95% of enterprises prioritize penetration testing as a critical defense strategy, only around 32% of their attack surfaces undergo active testing. This gap highlights vulnerabilities amid the increasing sophistication of AI-enabled cyber threats, which combine human expertise with autonomous AI-driven techniques.

Synack specializes in blending human-led and AI-powered penetration testing, leveraging a global network of security researchers alongside advanced agentic AI tools to continuously identify and mitigate vulnerabilities. The research underscores the growing necessity for scalable and continuous penetration testing approaches to keep pace with dynamic threat landscapes. Traditional manual testing faces scalability challenges, which AI-driven solutions like those offered by Synack aim to overcome. By incorporating agentic AI, enterprises can automate and expand penetration testing coverage more effectively, addressing emerging risks posed by hybrid AI-human attack methods.

This research emphasizes that despite widespread acknowledgment of penetration testing’s importance, many organizations remain underprotected due to limited testing scope. Bridging this gap by integrating AI-enhanced penetration testing platforms not only improves threat detection but also supports compliance and proactive risk reduction, which are essential in the face of evolving cyber attack techniques.