SAN FRANCISCO, Nov. 12, 2026 (GLOBE NEWSWIRE) -- Picus Security, the Autonomous Exposure Validation company, today announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override. The launch rebuilds Picus’s automated penetration testing for the agentic era on five years of enterprise deployments and thousands of automated pentests.
In the post-Mythos era, AI models find and weaponize vulnerabilities at machine speed: 36,971 CVEs were published in the third quarter of 2026, more than three times the prior year. Against that pace, even an organization that runs a pentest every month is untested for the other 29 days, and most organizations test once a year. The point-in-time pentest is becoming a historical artifact, and the question boards of directors now ask is “what is testing us right now?”
Agentic security has become one of the most heavily funded categories in cybersecurity this year, and for good reason: putting an adversary-grade attacker inside every network, every day, is the only test that keeps pace with adversaries who already do exactly that. What enterprises have lacked is one they can run in production, under their own rules, from a vendor whose automated pentesting has operated inside their environments for five years. That is what Picus is launching.
“Every security leader now faces an attacker who never sleeps, never waits for a change window, and gets smarter every month,” said Volkan Erturk, co-founder and CTO of Picus Security. “The only honest answer is to test the way they attack: continuously, creatively, and at machine speed. In a real enterprise, that takes more than the AI. It takes five years of learning, with hundreds of customers, exactly what an autonomous system may and may not do in production. We built the agentic engine on those rules, so it can be bold in how it thinks and disciplined in what it does.”
Thinks like an attacker, behaves like enterprise software
Picus Autonomous Penetration Testing runs the attack the way an adversary would. The AI agent reads the live environment, chooses the next technique and target, and links what it finds into attack paths toward the assets that matter most. It moves through reconnaissance, vulnerability assessment, initial access, and post-exploitation the way a red team would, doubling back whenever a new finding opens a better route, and it does not stop at spotting a weakness: it attempts the exploit and pushes for the next foothold. The business signs off on scope and techniques before anything runs, and the engine stays inside them; hard-deny rules block destructive actions no matter what. A single click stops everything, and every action is logged for audit. Teams set how far the agent may go (Cautious, Standard, or Elevated), and even the most cautious setting can surface a complete attack path. They also choose how the engine executes: fully agentic where exploration matters, or through Picus’s deterministic, pre-tested technique library where production demands predictability.
Attack paths, proven with evidence
The output is a set of attack paths: chains of real, successful steps that end in a concrete impact, such as a compromised machine, stolen credentials, a domain takeover, or access to sensitive data. A single successful exploit can be an attack path; one long chain can surface several. Each arrives with the evidence that proves it, evidence a CISO can take to the board, so a security team spends its time on what an attacker could actually do. And because the engine runs on the Picus agent customers already have, with no dependency on Active Directory, there is nothing new to deploy.
One backlog across the platform
Separate tools create separate queues. Findings from all three Picus products land in one shared, deduplicated findings model and one prioritized backlog:
- Picus Autonomous Penetration Testing executes real exploit chains end to end, with an agentic engine deciding every next move and proving the impact it reaches.
- Picus Breach and Attack Simulation shows which prevention and detection controls stopped, logged, or missed each step of the attack.
- Picus Exposure Validation proves exploitability across all exposures and assets.
One platform tells a security team what an attacker can do today, what the defenses would catch, and which fix comes first.
See it in action
Picus Autonomous Penetration Testing is available today to Picus customers as part of the Picus Autonomous Exposure Validation Platform; the full-agentic mode is available through an early access program. To see it in action, watch the recorded webinar, or request early access or a demo at https://www.picussecurity.com/platform/autonomous-penetration-testing.
About Picus Security
Picus Security, the Autonomous Exposure Validation company, pioneered Breach and Attack Simulation in 2013. The Picus platform validates attack surfaces, exposures, and security controls in one loop, proving what attackers can exploit and what defenses stop, then driving every exposure to a defensible decision and proven closure. Picus Breach and Attack Simulation, Picus Autonomous Penetration Testing, and Picus Exposure Validation work together, orchestrated by Picus Swarm and Numi AI, so security teams fix the gaps that matter at the speed today’s threats demand. Picus is a Gartner® Peer Insights™ Customers’ Choice for Adversarial Exposure Validation, AEV Solution Provider of the Year in the 2026 CyberSecurity Breakthrough Awards, and the #1 Innovation Leader for Automated Security Validation in the Frost Radar™ 2026. Picus is headquartered in San Francisco.
Follow Picus Security on X and LinkedIn.
Media Contact
Jennifer Tanner
Look Left Marketing
picus@lookleftmarketing.com
