Offensive Security Spending Rises Sharply as Agentic AI Reshapes Pentesting

Organizations are ramping up investments in offensive security as agentic AI introduces both new capabilities and new risks to penetration testing and red teaming operations. According to Theresa Lanowitz, chief analyst at Omdia, the growing sophistication of AI-driven attack tools is forcing enterprises to rethink traditional security testing methodologies. Lanowitz sat down with the Dark Reading News Desk to discuss how agentic AI is being evaluated for offensive security workflows and what defenders should watch for as these systems mature.

Agentic AI systems capable of autonomously chaining exploits, enumerating networks, and adapting attack strategies in real time are already drawing the attention of both security teams and adversaries. Lanowitz noted that while AI-assisted reconnaissance and vulnerability discovery can accelerate red team engagements, the same capabilities lower the barrier to entry for less skilled threat actors. She emphasized that defenders must stress-test their environments against AI-augmented adversaries and validate that exposed services are properly hardened — a process that begins with fundamentals like running a port scanner to identify unnecessary attack surfaces.

The conversation also touched on risk amplification: agentic AI tools trained on outdated exploit databases may produce unreliable results, while models that pull live vulnerability feeds can inadvertently expose sensitive scan data. Lanowitz recommended that teams evaluating AI-driven pentesting frameworks implement strict data handling policies and verify the integrity of their toolchains through independent validation. For organizations building their own AI security pipelines, hardening authentication credentials and ensuring secrets are not leaked into model contexts remains critical — a simple starting point is auditing employee credentials with a password checker to catch reused or compromised passwords before they enter training pipelines.

Looking ahead, Lanowitz predicted that offensive security budgets will continue climbing as CISOs recognize the dual-use nature of agentic AI. The challenge, she said, is balancing automation with human oversight to prevent AI tools from producing false positives or, worse, executing uncontrolled actions during live engagements. As the offensive security landscape evolves, threat intelligence teams will need to track not just emerging vulnerabilities but also the AI models and techniques adversaries are adopting, ensuring that defensive postures keep pace with an increasingly automated threat ecosystem.