REDWOOD CITY, Calif., July 21, 2026 (GLOBE NEWSWIRE) -- Synack, which offers the first truly AI-powered continuous pentest for enterprises, today published The State of Continuous Security Validation, a market study of enterprise security leaders and practitioners. The research found that 95% discovered high or critical vulnerabilities outside scheduled testing windows in the past year, including 42% who did so at least monthly. The findings expose a growing gap between the speed of change in enterprise environments and the cadence of point-in-time testing.

The research highlights three connected challenges:

• Coverage gap: 38% said at least one-quarter of their critical attack surface had not been independently tested or validated in the previous 90 days.
• AI trust gap: 79% would not act on an AI-generated finding without human validation.
• Maturity gap: Only 15% described their security testing and validation program as continuous.
  

Security leaders described the real-world consequences in their own words: "It simply means we operate with a constant blind spot, where new code changes run in production for days or weeks before they are finally validated." —CISO/CSO, enterprise respondent

AI Expands Coverage. Humans Prove What Matters.
The study shows strong interest in AI-assisted security testing, but not in AI operating without human judgment. Respondents expect AI to play a major role in scaling reconnaissance, finding potential vulnerabilities and expanding testing coverage. Human expertise remains central to validating exploitability, assessing severity and business risk, testing complex workflows, reducing false positives, and communicating risk to stakeholders.

"Point-in-time testing is reaching its limit because the environment changes faster than a scheduled test can represent," said Angela Heindl-Schober, Chief Marketing Officer at Synack. "The market direction is clear: AI expands coverage, humans prove exploitability, and security validation becomes continuous. The gap is not awareness. It is execution."

Continuous pentesting or validation was the leading method respondents named for confirming whether a finding is exploitable, at 22%. Yet only 15% would describe the maturity of their overall program as continuous. The most common barriers to achieving continuous security validation centered around compliance-driven test cycles, integration complexity, lack of trust in automated findings, false positives, difficulty proving ROI, and unclear ownership across teams.

"Automation can surface more signals, but security teams need evidence, not noise," said Mark Kuhr, Co-Founder and Chief Technology Officer at Synack. "Human researchers bring the creativity and context to chain weaknesses, confirm exploitability and show what an attacker can actually do."

A Human + AI Model for Continuous Security Validation
The findings reinforce the need for a Human + AI approach to continuous security validation. Sara AI Pentesting uses the Synack Autonomous Red Agent to expand reconnaissance and testing at scale, while the Synack Red Team brings rigorously vetted human expertise to validate real-world exploitability, identify chained attack paths, and provide the context automation cannot replicate. Together, they help organizations move beyond periodic snapshots toward continuous security validation.

Get the report: synack.com/state-of-continuous-security-validation

Research Methodology
Synack surveyed 97 security leaders, including CISOs, security directors, security architects, and offensive security professionals. The survey examined current testing practices, attack-surface coverage, testing triggers, approaches to vulnerability validation, and expectations for AI and human expertise.

About Synack
Synack delivers continuous pentesting through its Human + AI platform for continuous security validation. Sara AI Pentesting, powered by the Synack Autonomous Red Agent, combines agentic AI with the Synack Red Team—the world's most rigorously vetted community of security researchers—to help organizations proactively reduce risk, stay compliant, and stay ahead of evolving cyber threats. Sara handles reconnaissance, attack surface mapping, and initial exploit validation at scale, while human experts validate real-world exploitability and provide the creativity and judgement automation cannot replicate. Founded by former NSA operatives, Synack has enabled nearly 10 million hours of security testing to protect critical assets, from global financial systems to U.S. Defense Department networks. Synack was recognized by both G2 and GigaOm as a Leader in Penetration Testing and PTaaS. Learn more at synack.com and on LinkedIn.

Media Contact
Katy Nally
Senior Content Marketing Manager
cnally@synack.com