Security leaders are confronting a vulnerability window that industry data suggests averages 38 days—a period where attackers hold a decisive advantage. According to the newly released guide, threat actors can weaponize new vulnerabilities in approximately five days, while the median organization requires 43 days to deploy patches. This gap represents a critical exposure period, particularly given that public-facing application exploits account for nearly one-third of breaches.
To address this challenge, the guide advocates for "agentic pentesting"—deploying autonomous AI agents to conduct continuous, automated security testing. The approach aims to transform security from periodic audits into an integrated, real-time process operating at machine speed. By simulating attacker tactics at scale, these systems provide constant feedback, potentially shrinking the window during which organizations remain vulnerable.
The guide stresses that such powerful automation requires strict governance before production deployment. Essential controls include technical safeguards like dry-run modes and kill switches, complete auditability of agent actions, and scope locking to prevent unauthorized testing. Human oversight remains mandatory for high-risk decisions.
This framework attempts to balance automation's efficiency with robust risk management. For regulated industries, it offers a pathway to align continuous security validation with compliance requirements and rapid development cycles. Notably, the guide positions agentic AI as augmenting human security teams rather than replacing them, emphasizing disciplined implementation for measurable risk reduction.
As organizations consider this evolving approach, several open questions remain regarding performance metrics, resource investment, and compliance adaptations necessary for continuous automated testing to become standard practice.
安全主管正面對一個業界數據顯示平均長達38天的漏洞窗口期——在此期間，攻擊者握有決定性優勢。根據最新發布的指南，威脅行為者可在大約五天內將新漏洞武器化，而組織部署補丁的中位數時間則需43天。這一差距構成了一個關鍵的暴露期，尤其鑒於公開應用程式的漏洞利用佔據了近三分之一的安全事件。
為應對此挑戰，該指南提倡「智能滲透測試」——部署自主人工智能代理進行持續、自動化的安全測試。此方法旨在將安全防護從定期審計轉變為以機器速度運行的整合式即時流程。透過大規模模擬攻擊者戰術，這些系統能提供持續反饋，從而可能縮短組織處於脆弱狀態的時間窗口。
指南強調，如此強大的自動化在生產環境部署前需要嚴格的治理機制。必要的控制措施包括模擬運行模式和緊急終止開關等技術保障、對所有代理動作的完整審計能力，以及用於防止未授權測試的範圍鎖定。人為監督對於高風險決策仍然是強制性的。
此框架試圖平衡自動化的效率與穩健的風險管理。對於受監管的行業，它提供了一種將持續安全驗證與合規要求及快速開發週期相結合的途徑。值得注意的是，該指南將人工智能定位為增強而非取代人類安全團隊，並強調透過有紀律的實施來實現可量化的風險降低。
隨著組織考慮這種演進中的方法，關於績效指標、資源投入以及使持續自動化測試成為標準實踐所需的合規調整等幾個懸而未決的問題仍然存在。