TL;DR

• AI is automating large parts of traditional penetration testing
• Commodity-based testing is becoming less valuable
• Tools like AWS Security Hub and emerging AWS security agents are enabling continuous, on-demand testing
• The value of pentesting is shifting towards complex, high-skill engagements
• UK and New Zealand organisations are beginning to question traditional testing models

Why AI Is Changing Pen Testing

One of the more significant shifts we are seeing in cyber security is how AI in penetration testing is reshaping what testing actually means.

Traditionally, penetration testing has been:

• Periodic
• Manual
• Consultant-led
• Point-in-time

That model is now being challenged.

AI is enabling faster discovery, automated testing, and continuous assessment. In many cases, the initial phases of testing can now be completed in minutes rather than days.

This is not theoretical. It is already happening.

The Rise Of Commodity Testing

This is what we are seeing more and more:

👉 Commodity-based penetration testing is being disrupted

Basic testing activities such as:

• Vulnerability scanning
• Misconfiguration detection
• Initial reconnaissance

Are increasingly being automated.  With cloud-native tooling and AI-driven platforms, organisations can now:

• Run their own tests
• Pay on-demand (often billed to the second)
• Trial capabilities without long procurement cycles

This changes the economics completely.

For many organisations, particularly SMEs, the barrier to entry for security testing has dropped significantly.

AWS And The Move To Continuous Security Testing

This shift is particularly visible in cloud environments.

Platforms like AWS Security Hub and emerging AWS-native security agents are enabling organisations to move towards continuous security validation rather than periodic testing.

What this looks like in practice:

• Automated checks running continuously
• Real-time identification of misconfigurations
• Integration with CI/CD pipelines
• On-demand testing triggered by changes

The key difference is speed and accessibility.

Security testing is becoming:

• More frequent
• More accessible
• More embedded into operations

Rather than a standalone activity.

The Shift In Skill: Floor and Ceiling Rising

This is not the end of penetration testing.

It is a shift in the skill ceiling.

👉 The floor is rising
Basic testing is being automated, reducing the need for manual effort in lower-complexity engagements.

👉 The ceiling is rising
Modern environments are more complex:

• Multi-cloud
• API-driven
• Identity-centric
• Highly integrated

This creates demand for:

• Advanced attack simulation
• Business logic testing
• Identity and access exploitation
• Chained attack scenarios

The role of the pentester is evolving from:
“Find vulnerabilities”
➡️
“Understand how systems fail in real-world conditions”

What This Means for UK and New Zealand Organisations

Across both regions, we are starting to see similar questions emerge:

• Are we getting value from traditional pentests?
• Why are we paying for what tools can now do?
• Should testing be continuous rather than annual?

In the UK:

• Regulatory pressure still drives formal testing cycles
• But organisations are exploring more continuous models

In New Zealand:

• Cloud-first adoption is accelerating this shift
• Smaller teams are leveraging automation earlier

In both cases, the conversation is moving.

The Future of Pen Testing

Penetration testing is not disappearing. It is becoming more specialised.

We are moving towards a model where:

• Baseline testing is automated and continuous
• Advanced testing focuses on complexity and context

This creates a clearer distinction between:

• Commodity testing (increasingly automated)
• High-value testing (human-led, scenario-driven)

The Bigger Picture

The most important shift is not technological, it is strategic.  Security testing is moving from:

• A periodic compliance exercise
  ➡️
• A continuous operational capability

For organisations that still rely solely on traditional pentesting, there is a growing risk of misalignment with how their environments actually function.

The question is no longer: “Do we need a pentest?”

It is: “How are we continuously validating our security?”

👉If you’d like to learn more, contact us to explore how your security testing approach aligns with today’s cloud-first environments

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

Is AI replacing penetration testing?
AI is automating many basic testing tasks, but advanced penetration testing still requires human expertise.

What is continuous security testing?
Continuous testing involves ongoing automated checks rather than periodic assessments.

How is AWS changing penetration testing?
AWS provides tools that enable automated, real-time security checks integrated into cloud environments.

Is traditional pentesting still relevant?
Yes, but its role is shifting towards more complex, high-value testing rather than basic vulnerability discovery.