Picus puts AI agents on the offensive with autonomous pentesting
Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override.
Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override.
The launch rebuilds Picus’s automated penetration testing for the agentic era on five years of enterprise deployments and thousands of automated pentests.
In the post-Mythos era, AI models find and weaponize vulnerabilities at machine speed: 36,971 CVEs were published in the third quarter of 2026, more than three times the prior year.
It moves through reconnaissance, vulnerability assessment, initial access, and post-exploitation the way a red team would, doubling back whenever a new finding opens a better route, and it does not stop at spotting a weakness: it attempts the exploit and pushes for the next foothold.
And because the engine runs on the Picus agent customers already have, with no dependency on Active Directory, there is nothing new to deploy.
Against that pace, even an organization that runs a pentest every month is untested for the other 29 days, and most organizations test once a year.
What enterprises have lacked is one they can run in production, under their own rules, from a vendor whose automated pentesting has operated inside their environments for five years.
We built the agentic engine on those rules, so it can be bold in how it thinks and disciplined in what it does, and teams set how far the agent may go (Cautious, Standard, or Elevated), and even the most cautious setting can surface a complete attack path.
The output is a set of attack paths: chains of real, successful steps that end in a concrete impact, such as a compromised machine, stolen credentials, a domain takeover, or access to sensitive data.
A single successful exploit can be an attack path; one long chain can surface several.
The business signs off on scope and techniques before anything runs, and the engine stays inside them; hard-deny rules block destructive actions no matter what.
Findings from all three Picus products land in one shared, deduplicated findings model and one prioritized backlog: One platform tells a security team what an attacker can do today, what the defenses would catch, and which fix comes first.
What happened
Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override.
The launch rebuilds Picus’s automated penetration testing for the agentic era on five years of enterprise deployments and thousands of automated pentests.
In the post-Mythos era, AI models find and weaponize vulnerabilities at machine speed: 36,971 CVEs were published in the third quarter of 2026, more than three times the prior year.
What changed
It moves through reconnaissance, vulnerability assessment, initial access, and post-exploitation the way a red team would, doubling back whenever a new finding opens a better route, and it does not stop at spotting a weakness: it attempts the exploit and pushes for the next foothold.
And because the engine runs on the Picus agent customers already have, with no dependency on Active Directory, there is nothing new to deploy.
Who is affected
Against that pace, even an organization that runs a pentest every month is untested for the other 29 days, and most organizations test once a year.
What enterprises have lacked is one they can run in production, under their own rules, from a vendor whose automated pentesting has operated inside their environments for five years.
Why it matters
We built the agentic engine on those rules, so it can be bold in how it thinks and disciplined in what it does, and teams set how far the agent may go (Cautious, Standard, or Elevated), and even the most cautious setting can surface a complete attack path.
Technical details
The output is a set of attack paths: chains of real, successful steps that end in a concrete impact, such as a compromised machine, stolen credentials, a domain takeover, or access to sensitive data.
A single successful exploit can be an attack path; one long chain can surface several.
Response
The business signs off on scope and techniques before anything runs, and the engine stays inside them; hard-deny rules block destructive actions no matter what.
Findings from all three Picus products land in one shared, deduplicated findings model and one prioritized backlog: One platform tells a security team what an attacker can do today, what the defenses would catch, and which fix comes first.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.