AI Forces Organizations To A Higher Security Testing Maturity

Rohit Dhamankar, VP, M&A and AI Strategy at Fortra, with 15+ years of cybersecurity experience.

​For years, security teams operated on the assumption that once a vulnerability is disclosed, there is a considerable window of days or even weeks before anyone weaponizes it.

That assumption no longer holds. The gap between a vulnerability becoming public and it being exploited is now measured in minutes. Attackers didn’t suddenly get smarter. They gained access to the same AI tools everyone else did, and that access has democratized knowledge that used to take years of specialized training to acquire. The skill that once separated a script kiddie from a serious threat actor is thinning out.

However, many organizations are still operating on an older cadence: two penetration tests (pentests) a year to satisfy a compliance auditor and a defenses-first mindset that celebrated shaving a few days off critical patch time as a real win. Red teaming and penetration testing talent was expensive and rare enough.

Does that mean we no longer need great red teamers and penetration testers? Absolutely not. AI is exceptionally good at finding every known class of vulnerability and combining them in ways no human team could test for manually. But attack surfaces keep evolving, and finding an entirely new class of bug still requires the nonlinear leap and ingenuity only a person can muster.

The old vulnerability math doesn’t work anymore.

None of this is conceptually new. Chaining low-severity issues into something far more dangerous is a technique ransomware operators were using years before generative AI existed. Attackers were always stitching together remote vulnerabilities with privilege-escalation bugs that individually looked harmless.

AI has changed scale and speed. It can search for and assemble those attack chains automatically across far more surface area than a human team ever could, and it can do it continuously.