I Run a Company of Pentesters, and I Watch AI Bots Doing Their Job

This piece is my read on research published by Joseph Thacker. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.

I run a company of pentesters. And I watch AI bots doing their job.

Not just doing it. Doing it faster, cheaper, and a great deal more of it.

Joseph Thacker, one of the best-known researchers in the bug bounty world, published a forecast this week that made me swallow hard: in 2026 twice as many vulnerability reports will be submitted as last year. Not because there are more researchers. Because there are more bots.

Anyone can build a hackbot today. Tools like Claude Code let a single researcher scan, analyse and find weaknesses at a rate a whole team could not have reached a year ago.

But that is only the first half of the story

The second half? Companies will start running internal AI agents for code scanning and security testing. And then external reports will begin to shrink – because what is the point of paying a bounty on a weakness the internal bot already found?

The window of opportunity for human researchers? A year to two. Maximum.

So are pentesters going to disappear?

I think not. But the pentesters who survive will look completely different from what we know today.

The bot is excellent at finding generic XSS, basic IDOR, and configuration problems. But the bugs that genuinely break organisations? Those are the ones that require an understanding of the business logic, of the context, of what the developer meant to do rather than what they actually did. That is where you need a human.

In 15 years of AppSec Labs I have seen this over and over. The most painful breaches do not come from technical weaknesses. They come from mistaken assumptions. From business logic no scanner understands.

The question is not whether AI will replace pentesters. The question is which pentesters will survive, and what they will need to know how to do.

Anyone still making a living finding basic SQLi? Their time is up. Anyone who understands business logic, thinks like an attacker, and knows how to tell the story to the client? Worth more than ever.

I first shared a version of this as a LinkedIn post on 2026-03-28. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula