Pentesto does not exist because nobody can find flaws. It exists because the findings sit there. A report nobody has time to act on is a cost, not a protection.
The finding is not the problem
I have written these reports for years. I have also seen what happens to them afterwards. A week after the walkthrough the document is in a folder, and the three most serious findings have become three lines in a ticket system. That is not an accusation. It is arithmetic.
During 2025, 48,185 new public vulnerabilities were published. The year before the figure was 39,962. That is just over twenty percent in a single year, and no development team grew at that rate.[04][05]
48 185
new public vulnerabilities were published in 2025, against 39,962 the year before. Your own list is a small part of that curve. It is still the part you have to answer for.[04][05]
The Cyentia Institute measured how much organisations actually manage to close. The answer was about one in ten open flaws a month, and it held whether the company was large or small. Capacity is effectively fixed. The only thing you steer is what enters the queue.[03]
A hundred-line report is not information. It is work you just received.
The queue becomes a debt
Veracode measures every year how long it takes to fix flaws in real code. The average has gone from 171 days in 2020 to 252 days in 2025. Almost half of all organisations, 49.9 percent, carry serious flaws that have been open for at least a year. That is called security debt, and the interest on it shows up in no budget.[02]
Verizon's review of real breaches shows the same thing from the other side. Of the known exploited flaws in internet-facing equipment, about 54 percent were fully fixed during the year, at a median of 32 days. The rest stayed open. Not because nobody knew about them.[01]
Small teams pay the most
The same material shows who gets hit. Among small and medium-sized organisations, ransomware was present in 88 percent of breaches. Among large ones the figure was 39 percent. The difference is not that the small ones are sloppier. It is that they have fewer layers between themselves and an attacker.[01]
A small team has no security department sorting things for them. They have one release train, one sprint and a backlog that is already full. When the report lands there it competes with everything else, and it rarely wins. So the report has to be short, ranked and proven. Otherwise it loses.
What the machine actually moved
In August 2025, DARPA's AI Cyber Challenge was decided. The competing systems found 54 planted vulnerabilities in the contest tasks and patched 43 of them. They also found 18 genuine vulnerabilities in real open source code and delivered eleven working fixes. So the machines did not only find. They proposed the repair as well.[06]
That is the whole reason Pentesto looks the way it does. The agent takes breadth and tempo, so the expensive hours go to two things. Proving a finding holds, and writing down how it gets repaired. The price is set on scope up front, so a test can happen more often than once a year.
What the machine has actually found
The machine makes the list long. The human makes it short again.
Soon it is a date
From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities to EU authorities. An early warning within 24 hours, a full notification within 72, a final report no later than 14 days after a fix exists. The requirement is not about finding. It is about being able to answer.[07]
That does not shorten the queue. It makes it visible, and now with a clock on it. Whoever already knows what is open at home gets an easier week than whoever finds out at the same time as everyone else.