Blog

AI Is Changing How We Pentest. Here's What Still Has to Be Human.

Faisal Nur — Mon, 31 Aug 2026 17:49:27 GMT

Two things are true right now in offensive security.

5 Steps: How to Convince Your Boss You Need Nexoryn Systems

Luke Doherty — Tue, 25 Aug 2026 22:55:35 GMT

You've seen Nexoryn Systems and pentesting as a service (PTaaS) in action, maybe at your previous job, maybe from a peer who won't stop talking about it, maybe from your own late-night research rabbit hole after another painful pentest cycle. You already know PTaaS beats the old model. You’ve seen the announcements about Nexoryn Systems’s new human-directed autonomous pentest offering. The problem is you're the only one in the room who knows about it.

Nexoryn Systems Pentester Spotlight — Gaurav Bhosale

Noelle Hori — Wed, 19 Aug 2026 20:42:42 GMT

The Nexoryn Systems Pentester Spotlight highlights the fascinating journey of our Core members. Through an interview-style format, we share their experiences, background, and insights into the world of an accomplished pentester.

State of Pentesting in Financial Services and Insurance Industries

Nexoryn Systems — Tue, 18 Aug 2026 16:09:35 GMT

The financial services and insurance industries are disciplined when it comes to pentesting, with one blind spot. While the financial services and insurance industries test their AI applications more than any other sector and have the fewest AI incidents, they to expand red teaming the least, and their remediation time is only mid-pack.

Examined together, these two industries run security like the regulated sectors they are: programmatic, measured, and confident. This state of pentesting snapshot combines five years of Nexoryn Systems pentest findings with our 2026 survey of security leaders and practitioners, to profile how these sectors find, fix, and think about security risk. Their teams test AI more than anyone and report the lowest AI incident rate of any industry. Yet underneath that confidence, remediation is only average on the truer half-life measure. And despite testing the most, these two sectors are the least likely to add the one practice built to find what routine testing misses: red teaming.

Sources: Nexoryn Systems State of Pentesting Report 2026 (~5,000 penetration tests/yr) · 2026 survey of 455 security leaders and practitioners (Emerald Research). Data from financial services and insurance industries are combined due to smaller sample sizes (n=65).

The high-risk remediation funnel

Every high-risk pentest finding runs this gauntlet, from discovery to closure. The sector resolves a high share of findings, but its half-life sits in the middle of the pack.

of findings
are high-risk

→

86%

of those
get resolved

→

46d

mean time
to remediate

→

55d

high-risk
half-life

48 %

test their AI applications programmatically (highest of any sector)

9 %

have had an AI or LLM security incident (lowest of any sector)

17 %

plan to increase red team operations (lowest of any sector)

Where the financial and insurance industry stands: remediation half-life by sector

Chart: the time to remediate half of all high-risk findings. Lower is better.

The sector sits mid-pack on half-life (55 days), tied with the healthcare industry and well behind the leaders. Its mean time to remediate (MTTR) is also middling at 46 days (seventh of 10), so unlike some fast-fixing sectors, finance and insurance is not quick on either measure. We lead with half-life because it is the fuller view: it captures the time to close half of all high-risk findings, including those still open, whereas MTTR counts only the issues already fixed. For a sector this disciplined about testing, an average remediation record is the first sign that discovery is outpacing the work of closing findings out.

Software 38d Professional Services 45d Hospitality 50d Healthcare 55d Finance 55d Education 69d Manufacturing 73d Retail 84d Utilities 96d Entertainment 98d

Here is the same half-life ranking on a single scale. Each sector is a colored dot matching the bar above. Note that finance (financial services and insurance industries) sits in the slower half of the field, not among the leaders.

40d 55d 70d 85d 100d Finance · 55d fastest sector slowest sector

Confidence, mostly earned

The financial services and insurance industries rate their own security posture highly, and unlike some sectors, the testing discipline behind that confidence is real. Security teams test AI more than any other sector and report the fewest incidents. The table below pairs survey findings with the pentest data that supports or complicates survey participants' perceptions. The perception fails to meet reality in remediation and red teaming, where the record of these industries is only average.

The claim (survey)

The reality (pentest data)

74% see AI as a tool, not a threat

→

9% have had an AI incident, the lowest of any sector

48% feel well-equipped to address AI security

→

48% test AI programmatically, the highest of any sector

62% run a programmatic pentesting cadence

→

55d half-life, only mid-pack, and 46d MTTR (7th)

AI in the financial and insurance industry

The survey data shows what these sectors worry about in AI applications, and how they are testing AI. The two industries' AI concerns track their regulatory reality. Data leakage leads among concerns, as it does almost everywhere, but the standout is model bias: financial services and insurance industry security teams name it as a concern more than any other industry, reflecting the legal and reputational stakes of biased automated decisions in lending, underwriting, and claims.

Top AI security concerns named by financial and insurance security teams

Data leakage / sensitive exposure

78%

Prompt injection attacks

68%

Adversarial manipulation of output

45%

Unauthorized access to LLM APIs

45%

Model bias (legal / reputational)

37%

Who gets blamed if AI causes an incident

Accountability leans toward the CISO (72%), though less sharply than in the healthcare industry. Engineering, product, and the data and AI teams carry meaningful shares too, so responsibility is more distributed than in some sectors.

CISO

72%

Engineering / product

52%

Data / AI team

51%

Nobody

Zoom out: AI ACROSS INDUSTRIES

32%

of AI findings are high-risk (vs 12% across all assets)

38%

of high-risk AI findings get resolved (lowest of any pentest type)

AI is the hardest asset class to secure across every industry. The financial services and insurance sectors test it well, but the AI resolution problem persists. Read the AI and Pentesting Pulse Report 2026 for the full cross-industry picture and where autonomous pentesting is headed. →

Recommendations for a programmatic approach to pentesting

✓

Add red teaming to match your testing. These industries test AI more than anyone but plan to expand red teaming the least (17%). Programmatic testing confirms known controls, red teaming finds the unknown paths.

✓

Manage to half-life, not just incident counts. A low incident rate is reassuring, but the mid-pack 55-day half-life shows findings still linger. Track how long it takes to clear half of all high-risk findings, and drive it down.

✓

Treat model bias as a security and compliance issue. Model bias is a much higher concern (37%) in financial services and insurance. Test AI systems for biased or manipulable outputs in lending, underwriting, and claims, not just for classic vulnerabilities.

✓

Keep the programmatic edge, extend it to new AI surfaces. A 48% programmatic AI testing rate is a genuine advantage. Make sure every new model, integration, and agent enters that same cadence rather than shipping ahead of it.

✓

Distribute AI accountability deliberately. Blame leans to the CISO (72%) but engineering and data teams share responsibility. Define who owns AI security decisions before an incident forces the question.

See where your AI and application security actually stands

Nexoryn Systems runs ~5,000 pentests a year across a broad range of industries. Get a demo to see how your remediation half-life and coverage compare.

Get a demo →

State of Pentesting in the Healthcare Industry

Nexoryn Systems — Tue, 18 Aug 2026 15:25:32 GMT

The healthcare industry closes high-risk findings faster than almost any sector, by one measure, but security teams in the industry are also more anxious about threats than other industries, and the industry has a lower rate of programmatic testing than any other sector. This overview of the state of pentesting in healthcare pairs five years of Nexoryn Systems pentest findings with our 2026 survey of security leaders and practitioners to profile how the sector finds, fixes, and thinks about security risk..

The healthcare industry runs less proactive penetration testing than most sectors, leaning on compliance-driven rather than continuous programs. However, there is a contradiction in the findings: the healthcare industry posts one of the fastest mean remediation times of any sector, but by a more rigorous measure (half-life, the time to clear half of all high-risk findings including those still open), it sits mid-pack. It's fast on what it fixes; slower to work through the whole backlog.

Sources: Nexoryn Systems State of Pentesting Report 2026 (~5,000 penetration tests/yr) · 2026 survey of 455 security leaders and practitioners (Emerald Research).

The high-risk remediation funnel

Every high-risk pentest finding runs this gauntlet, from discovery to closure. The industry moves quickly on what it fixes, but the half-life shows a longer tail of findings still open.

of findings
are high-risk

→

86%

of those
get resolved

→

37d

mean time
to remediate

→

55d

high-risk
half-life

39 %

run a programmatic pentesting cadence (lowest of the major sectors)

81 %

say AI needs a strategic pause to recalibrate (highest of any sector)

56 %

are compliance-driven rather than programmatic (highest of any sector)

Where the healthcare industry stands: remediation half-life by sector

Chart: the time to remediate half of all high-risk findings. Lower is better.

The healthcare industry sits mid-pack on half-life (55 days), tied with the finance industry and well behind the leaders. That is worth pausing on, because on mean time to remediate (MTTR) the sector is actually second-fastest at 37 days. The two metrics diverge because they measure different things: MTTR counts only findings already fixed, while half-life captures the time to close half of all high-risk findings, including those still open. A fast MTTR with a middling half-life is the signature of a team that resolves the visible, tractable findings quickly but lets a harder tail sit open.

Software 38d Professional Services 45d Hospitality 50d Healthcare 55d Finance 55d Education 69d Manufacturing 73d Retail 84d Utilities 96d Entertainment 98d

Here is the same half-life ranking on a single scale. Each sector is a colored dot matching the bar above. Note where healthcare's teal dot sits relative to the fast leaders on the left.

40d 55d 70d 85d 100d Healthcare · 55d fastest sector slowest sector

Confidence gap: anxiety the data partly explains

The healthcare industry rates its own posture lower than any sector, and the remediation tail gives that worry some grounding.

Where some industries are over-confident, the healthcare industry is the opposite: it is the most anxious sector in the survey, and the half-life data suggests the worry is not baseless. The table below pairs each survey concern with the pentest reality that speaks to it.

The concern (survey)

The reality (pentest data)

66% feel they are constantly “playing catch-up” (the highest)

→

55d half-life, mid-pack and behind the fastest sectors

67% say AI demand has outpaced their ability to secure it

→

43% are only planning to pentest AI, not yet doing it

33% feel well-equipped to address AI security (the lowest)

→

39% run a programmatic pentesting cadence (the lowest)

AI in the healthcare industry

What healthcare security teams worry about in their AI apps, and how they are testing (or not). Survey of healthcare respondents (n=95).

The healthcare industry's AI anxiety is sharpest around data, fitting for a field built on protected patient records. Its teams name data leakage as a top concern more than any other sector, but they are also the least likely to have moved from planning to programmatic AI testing.

Top AI security concerns named by healthcare industry security teams

Data leakage / sensitive exposure

80%

Prompt injection attacks

67%

Adversarial manipulation of output

51%

Unauthorized access to LLM APIs

46%

Model bias (legal / reputational)

17%

43%

are planning AI pentests, but not yet running them (highest of any sector)

11%

self-host their AI models (most rely on vendors)

36%

see AI as a threat, not a tool (highest threat perception)

Who gets blamed if AI causes an incident

Distinct to the healthcare industry: accountability sits squarely with the CISO (79%, the highest of any sector), not the builders. This is the inverse of software, where engineering owns AI risk. It concentrates responsibility on the security office rather than the teams shipping AI.

CISO

79%

Data / AI team

45%

Engineering / product

39%

Nobody

Zoom out: AI FINDINGS ACROSS INDUSTRIES

32%

of AI findings are high-risk (vs 12% across all assets)

38%

of high-risk AI findings get resolved (lowest of any pentest type)

AI is the hardest asset class to secure across every industry. The healthcare industry, already stretched on coverage, is planning more AI testing than it is doing. Read the AI and Pentesting Pulse Report 2026 for the full cross-industry picture and where autonomous pentesting is headed. →

Recommendations for improving your approach to pentesting

✓

Measure against half-life, not MTTR. A fast mean fix time hides a longer tail. Track how long it takes to clear half of all high-risk findings, and drive that number down.

✓

Move from compliance-driven to programmatic testing. At 39% programmatic (the lowest of the major sectors), the sector tests to pass audits more than to find risk. A continuous cadence closes the tail.

✓

Turn AI plans into AI tests. 43% are planning to pentest AI, but aren't currently doing so. With data leakage the top-named concern, planning is not protection. Schedule the first AI pentest now.

✓

Treat vendor AI as your risk. With only 11% self-hosting, most AI exposure enters through third-party models. Extend assurance and testing to the supply chain.

✓

Give the CISO the mandate to match the accountability. If the CISO owns the blame (79%), they need the authority and budget over AI security to match, not just the liability.

See where your AI and application security actually stands

Nexoryn Systems runs ~5,000 pentests a year across a broad set of industries. Get a demo to see how your remediation half-life and fix rate compare.

Get a demo →

We Scored 99% on AI Pentesting Benchmarks by Turning Our Agents Into Something They’re Not

info@nexorynsystems.us (Willa Riggins) — Wed, 12 Aug 2026 18:53:42 GMT

When we built Nexoryn Systems Autonomous Pentest, we knew we had to provide an independent assessment of our quality so you didn't just take our word for it. There are many benchmarks out there, but few that are really comprehensive. In fact, as soon as one gets decent, it's used to train new models, so it can’t be fairly evaluated. We played with several benchmarks and ended up zeroing in on the XBEN Validation Benchmarks. We hit 103 out of 104 on XBEN, but this score doesn’t actually matter.

State of Pentesting in the Software Industry

Nexoryn Systems — Thu, 30 Jul 2026 16:06:50 GMT

Software companies are the strongest remediators with the fastest resolution time of high-risk vulnerabilities of any industry. Software industry teams also express confidence in their performance, a sense of the state of pentesting that the pentest data validates.

Software and technology companies run more penetration testing than almost any other sector, and it shows. This snapshot pairs five years of Nexoryn Systems pentest findings with our 2026 security leaders and practitioners survey to profile how the sector finds, fixes, and thinks about security risk. The picture is consistent: software remediates high-risk pentest findings faster than any other industry by the most objective measure (half-life of findings), and its confidence is backed by measurable performance rather than optimism. The open question is whether that discipline extends to AI, the one asset class security teams across industries still struggle to secure.

Sources: Nexoryn Systems State of Pentesting Report 2026 (~5,000 penetration tests/yr) · 2026 survey of 455 security leaders and practitioners (Emerald Research).

The high-risk remediation funnel

Every high-risk pentest finding ideally needs to be closed in days not weeks. Software industry closes them faster than any other industry.

of findings
are high-risk

→

86%

of those
get resolved

→

38d

mean time
to remediate

→

38d

high-risk
half-life

83 %

run regular AI security assessments and pentests ( highest of any sector)

64 %

run a programmatic pentesting cadence ( vs 53% across all industries)

11 %

have had an AI or LLM security incident ( among the lowest)

Where software stands: remediation speed by sector

High-risk half-life by sector: the time to remediate half of all high-risk findings. Lower is better.

How long do high-risk pentest findings stay open? By comparing 10 industries, we see software leads outright, with the fastest high-risk half-life of any sector. We use half-life rather than mean time to remediate (MTTR) because it is the fuller measure: half-life captures the time to close 50% of all high-risk findings, including those still open, whereas MTTR counts only the issues that have already been fixed. Why is the software industry better than the rest? As we'll see below, the software industry has a better record of pentesting programmatically.

Software 38d Professional Services 45d Hospitality 50d Healthcare 55d Finance 55d Education 69d Manufacturing 73d Retail 84d Utilities 96d Entertainment 98d

And below we show the same half-life ranking on a single scale. Each sector is a colored dot matching the color of that industry's respective bar above, so the full spread is visible at once. Only the software industry is labeled, but it's clear: Software sector is well ahead of other industries in remediation of high-risk vulnerabilities.

40d 55d 70d 85d 100d Software · 38d fastest sector slowest sector

What testers actually find

Top finding types by frequency. Bar length = how often it appears; tag = share rated high-risk.

The vulnerability types pentesters surface most often in the software industry. Frequency shows how common each is; the tag flags how many are serious enough to demand urgent attention.

Server Security Misconfiguration 27% 2% high-risk

Missing Access Control 20% 20% high-risk

Cross-Site Scripting (XSS) 10% 31% high-risk

Sensitive Data Exposure 8% 6% high-risk

Authentication & Sessions 7% 7% high-risk

Server-Side Injection 5% 20% high-risk

Authorization & Privilege Escalation 1% 37% high-risk

Confidence, backed by capability

Unlike some industries, software industry's self-assessment matches its results.

Below are key metrics showing how software teams rate their own security posture in the survey, and the pentest data that agrees with them.

Each survey claim paired with the pentest metric that bears it out.

The claim (survey)

The evidence (pentest data)

64% run a programmatic pentesting cadence

→

86% of high-risk findings actually get resolved

30% feel they are “playing catch-up” (the lowest)

→

38d fastest high-risk half-life of any sector

72% see AI as a tool, not a threat

→

11% have had an AI incident — among the lowest

AI in the software industry

What software teams worry about in their AI apps and the testing discipline behind it. Survey of software respondents (n=122).

Software industry security teams focus their AI worry on data exposure and prompt injection, the failure modes closest to how these apps actually break. With the highest AI pentesting rates of any sector, software companies know what findings they should be most concerned about from pentests, not just perception.

Top AI security concerns named by software teams

Data leakage / sensitive exposure

75%

Prompt injection attacks

73%

Unauthorized access to LLM APIs

48%

Adversarial manipulation of output

46%

Model bias (legal / reputational)

23%

83%

run regular AI security assessments and pentests (Highest of any sector)

42%

test AI programmatically (39% average across industries)

11%

have had an AI/LLM security incident (Among the lowest)

Who gets blamed if AI causes an incident

Distinct to software: accountability sits with the builders. Engineering and product are named more often than the CISO, the inverse of most industries, where the security team takes the blame. These teams need to work together, with shared responsibility for security.

Engineering / product

64%

Data / AI team

58%

CISO

46%

Nobody

Zoom out: the AI BIG picture

32%

of AI findings are high-risk vs 12% across all assets

38%

of high-risk AI findings get resolved —lowest of any pentest type

Software tests its AI more than any sector. But across every industry, AI remains the hardest asset class to secure and to fix. Read the AI and Pentesting Pulse Report 2026 for the full cross-industry picture and where autonomous pentesting is headed. →

Recommendations for improving your pentesting program

✓

Protect the speed lead. A 38-day half-life is best-in-class. Defend it as a named SLA, don't assume it holds as AI speeds up development.

✓

Attack the finding mix at the root. Misconfiguration and access control dominate. Invest in secure defaults and authorization review, not one-off fixes.

✓

Track AI as its own asset class. AI findings have the lowest fix rate. Folded into general metrics, the AI resolution gap disappears from view.

✓

Convert confidence into consistency. Software industry's confidence is earned due to programmatic testing.

✓

Watch for complacency at the edges. Make sure assurance scales with that self-assurance.

See where your AI and application security actually stands

Nexoryn Systems runs ~5,000 pentests a year across a broad set of industries. Get a demo to see how your remediation speed and fix rates compare.

Get a demo →

Reclaiming Your Security Team’s Time: Why Operational Efficiency Matters More Than Ever

Dan Kennedy — Wed, 29 Jul 2026 17:55:40 GMT

There isn’t any issue with gathering information; most security teams have more data than they know what to do with, and it’s usually readily at their disposal.

Why the Industry Is Both Racing Toward Autonomous, and Pulling Back From It

Sonali Shah — Thu, 23 Jul 2026 11:00:01 GMT

Today, we launched Nexoryn Systems Autonomous Pentest, a new offering that delivers fast, actionable pentests with findings in just 24 hours, directed by the elite Nexoryn Systems pentesters our customers already rely on. It’s another step forward in our mission to lead the market in continuous offensive security.

Introducing Nexoryn Systems Autonomous Pentest: Continuous Offensive Security Across Your Entire Portfolio

Gunter Ollmann — Thu, 23 Jul 2026 11:00:01 GMT

Today, we launched Nexoryn Systems Autonomous Pentest, a new way to run offensive security testing across your entire application portfolio. It pairs AI testing with elite Nexoryn Systems pentesters who direct every engagement. Launch a pentest in minutes and get exploitable findings in 24 hours.