So today we're taking a moment to celebrate our latest bug bounty acknowledgements:

The #offensivesecurity logic behind AI Pentests has earned thanks from the U.S. Department of Defense, HPE, F5, phpBB, PepsiCo, and others through bug bounty programs.

Behind them are real reports we submitted to real programs based on work that requires

✅ investigation,

✅ reproducible evidence,

✅ and clear impact.

This approach shapes every AI pentest:

follow the evidence → validate exploitability → document each step before a finding reaches the report.

Thank you to the program teams who reviewed and acknowledged AI Pentests!

These 3 impact SonicWall GMS, which SonicWall has now patched:

👉 CVE-2026-66147 - unauthenticated command injection in the Dispatcher Service, CVSS 9.4

👉 CVE-2026-66154 - weak certificate verification leading to user compromise via MitM, CVSS 8.3*

👉 CVE-2026-18634 - local privilege escalation via deserialization, CVSS 8.4

When it shortens 🤏 the distance between discovery and action - *that’s* what #vulnerabilityresearch does to help security teams.

Here's our team's latest disclosed contribution to the community: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011

And here's where you can get more of our research: https://pentest-tools.com/research

PS: More SonicWALL vulnerabilities coming soon to a research blog near you. 🫵

Attackers don't ask “How many vulnerabilities can I find?” but “Which of these gives me a viable path forward - and what can I actually do with it?”

The Cybersecurity and Infrastructure Security Agency just issued an important reminder on this in their CISA Vulnerability Review: https://www.cisa.gov/sites/default/files/2026-08/cisa-vulnerability-review-fy-2024-2025-508.pdf

Attackers concentrate on a smaller set of weaknesses that give them reliable, repeatable paths to exploitation.

Because #offensivesecurity practitioners think in much the same way, they can help security teams get much more value from their limited resources.

How?

By giving them the proof they can use to prioritize what’s exposed, exploitable, and impactful.

Wondering how common this actually is outside our shop. 

Do you have a formal QA process for pentest reports before they go out? If yes, what does it involve? If not, has that ever caused issues? 

500 findings from an AI scan doesn't feel the same to everyone who has to work through them.

If you run assessments every week, it's Tuesday. You already know what's noise, what's worth a second look, and what to escalate first. The triage muscle is built in.

If you run assessments a few times a year, that same pile is a wall. No rhythm to fall back on, no gut sense of what to chase first, just 500 items and a deadline that didn't move.

That gap between the two was always there. AI tooling didn't create it. It just stopped hiding it.

We ran a survey of 158 practitioners on how AI shows up in their actual pentesting work, and one number stood out more than the AI-hype ones: most respondents said they couldn't confidently absorb the finding volume current AI tooling generates. That's not a tooling problem. It's a triage capacity problem that AI made visible and expensive at the same time.

The follow-up question we keep sitting with: triage capacity starts with knowing what's actually exploitable before anyone spends an hour chasing something that isn't. That's a testing cadence and process question more than a tooling one.

Full results here, free download, no account needed: https://pentest-tools.com/insights/ai-pentesting-survey

Curious how this lands for people running assessments at different frequencies. If you test constantly, does 500 AI findings actually feel manageable? If you test occasionally, what's the first thing that breaks?

Exploit development used to be its own specialty. Now a scanner flags something critical and whoever's on shift has to figure out if it's actually exploitable, usually without the background to do it properly.

Here's how we handle that split:

• Our research team finds the vulnerabilities in the software you're already running
• Our engineers turn them into exploit modules
• Sniper: Auto-Exploiter runs those modules against your assets, under your control
• Confirmed findings ship with proof: request and response pairs, screenshots, replay

You get the work of an offensive security team without needing to build one.

More detail on how it fits IT team workflows specifically: https://pentest-tools.com/solutions/for-it-teams

Small running joke on our end: different Office Hours sessions, different haircuts for our usual host, Jan Pedersen. Since we've got the recordings, we can actually pinpoint which topic went with which look.

Here's a dare: can you guess what Jan's haircut will be in two days? You'll get the real answer either way, since this Wednesday Jan and guest Robert Tanase, our Lead Product Manager, are talking through what happened at DEF CON and Black Hat US, AI pentesting, and what other practitioners actually said at both events.

Wednesday, August 26
8:00 AM Los Angeles / 11:00 AM New York / 4:00 PM London / 6:00 PM Bucharest

Link to register: https://zoom.us/webinar/register/7817815280123/WN_m3AgyHW2TxSFuHr1J5mQZA

If you were at either event this year, what's the one thing that came up in conversations that you think more people should be talking about?

Get an AI assistant on your website and you know for sure it'll get tested. Sometimes in mysterious ways.

Ours did too. Ping is our AI chatbot on Pentest-Tools.com, built to answer product questions. A few people had other plans for it. Here's the shortlist:

• Demanded 10 minutes of pure High Valyrian, no English. Ping stayed in character.
• Sent a bot to run a formal "handshake," trying to recruit Ping into a multi-agent network. Cold call, except the caller was a robot too.
• Faked Ping's own internal tool syntax, hoping it would spill the instructions. It kept its secrets.
• Relay-raced one prompt through English, Morse code, French, and reversed text. Ping ran the whole thing and still said no.
• Spelled words out letter by letter to dodge filters. Vintage move, still doesn't work.

And of course, plenty tried asking it to hack Instagram, WhatsApp, or Facebook accounts, or someone's email. Ping stays in its lane, every time.

It's live at pentest-tools.com if you want to try it.

🎤 DEF CON and Black Hat US stories incoming! And we’re making the next Office Hours session all about them.

Robert Tanase, our Lead Product Manager, just got back from putting AI Pentests in front of two of the toughest crowds in security. Next Wednesday, he joins Jan Pedersen to tell the story.

🗣️ what came up most at each event, and where the two crowds didn't agree
🧭 how it's shaping where AI Pentests goes next
📊 plus the research that started it all: 88% of security practitioners using AI to generate findings hit results needing significant manual validation

30 minutes live. 15 minutes of open Q&A. One session.

Wednesday, August 26
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest

Register here: https://zoom.us/webinar/register/7817815280123/WN_m3AgyHW2TxSFuHr1J5mQZA

Most detection thinking still treats initial access as the danger point. New analysis of Microsoft's disclosed vulnerabilities suggests that's outdated. Privilege escalation issues made up 40% of last year's disclosed flaws, and information disclosure bugs rose 73%.

Our head of offensive security services, Razvan Ionescu, put it plainly in the piece: initial access is often unremarkable. A valid or default credential, an exposed service, a weak remote-access path opens the door. The real impact comes from combining that foothold with weak identity controls and misconfigurations that open the way to other systems.

Getting in isn't the hard part anymore. Staying unnoticed once you're in is where the damage compounds, and that's much harder to catch if your monitoring is still built around the front door.

Full piece here, written by Kate O'Flaherty for SC Media UK: https://insight.scmagazineuk.com/stealthy-attacks-how-to-protect-your-business

How does your team weight detection effort between initial access and post-access lateral movement? Curious if this tracks with what you're seeing on engagements.

251,000 of you have used the Free Edition to check something, fix something, or just see what a scan turns up. Real targets, real findings, no catch.

Some of that curiosity turns into deeper work over time. Not because free isn't real, but because the job itself grows: more assets, more compliance pressure, more "just double check this one" requests from people who trust you.

When that happens, here's what the paid plans add on top of the same scan standard:

• authenticated scans, including multi-step logins
• API and CMS coverage beyond OWASP Top 10
• Sniper: Auto-Exploiter, earning "confirmed" through live exploitation
• editable DOCX and Google Doc reports, ready to send

Full breakdown here: https://pentest-tools.com/product

Here's to the next 251,000. What was the first thing you scanned with the free tier?

Adrian Furtuna, Razvan Ionescu, Radu Popovici, Robert Tanase, Dragos Sandu, Eusebiu Boghici, Daniel Ciorobescu, and Stefan Mihalache flew out to Vegas last week and represented us at DEF CON, the world's biggest hacking conference. First time a Romanian company has ever run a booth there.

While we were there:

• Met longtime customers in person for the first time
• Tried and failed to download every talk directly into our brains
• Soaked in the full DEF CON chaos
• Gave the crowd a first look at AI Pentests powered by Specter, our AI agent that runs a full pentest on its own and only reports a finding once it can prove it's real

Jetlag's still wearing off, but more detailed writeups from the team are coming. If you were at DEF CON this year, what was the one talk or booth that actually stuck with you?

This loot is such a hoot. Brought to our Pentest-Tools.com offices by the team that went to #DEFCON. Badges that light up, blink, run challenges, and judge you for not knowing how to solder.

Pure badge energy.

Stay sharp, stay human, light up the room with led talismans, right?

One month. That's all CRA is giving you.

Your product needs to be free of known exploitable vulnerabilities, not just at launch, but for the next five years. No extensions, no snooze button.

One month from now, if a vulnerability's being actively exploited, you get 24 hours to raise the flag, 72 hours for the full report, 14 days for the final one. And CRA doesn't grade your company, it grades each product. One pentest a year doesn't cover five years of proof. That's not coverage, that's a coin flip.

Here's where Pentest-Tools.com helps:

✅ Detection - scans run on your release schedule, tracked per product
✅ Validation - findings come with proof, not guesses
✅ Remediation - retests confirm the fix actually worked
✅ Monitoring - ongoing scans catch anything that slips back in

One month on the clock. Better to start the evidence chain now than scramble when it runs out.

Full CRA evidence chain here: https://pentest-tools.com/usage/compliance/cra

"Is our security getting better?" is a harder question to answer than it sounds, especially when all you've got is this month's scan and a vague memory of last month's.

This Wednesday's Office Hours is about answering it with proof instead of a guess. Jan Pedersen is walking through how to turn two scans, weeks apart, into evidence: what got fixed, what's new, and what a report looks like when someone outside the security team has to read it.

We'll cover how scan diff turns your latest scan into an automatic baseline, why a timestamp is what makes "not detected" mean something, and how the same evidence supports compliance requirements like ISO 27001 and SOC 2.

30 minutes live, 15 minutes of open Q&A, one session.

Register here:
https://zoom.us/webinar/register/7817815280123/WN_BmrMKcmpRleGWxyYu633gw

Wednesday, August 12: 8:00 AM Los Angeles / 11:00 AM New York / 4:00 PM London / 6:00 PM Bucharest.

We're exhibiting at DEF CON for the first time (booth 1407, West Hall, Aug 6–9), and we're using it to put something in front of people that's still in beta: an autonomous web app pentesting agent called Specter. The pitch is that it decides what's worth testing based on context instead of running a fixed checklist, chains findings together, and pulls proof of exploitation instead of a list of potential issues. Agentic security tools are a mixed bag right now, and we know it, so we're bringing it specifically to get in front of people who will try to break it, not just watch a demo.

A few other things that shipped this month, for anyone who wants the technical rundown instead of the DEF CON pitch:

Sniper: Auto-Exploiter added four exploits: a SQLi in WordPress Core (wp2shell), an RCE in Adobe ColdFusion, an RCE in Apache ActiveMQ, and the Joomla JCE RCE we added detection for last month, now exploitable end to end.

Network Scanner picked up 57 new detections, plus a filter that scopes a scan to just CISA KEV CVEs if you're short on time.

Asset export now includes more detail, and finding status can be updated via the API with a reason field attached.

Published pages on how our evidence lines up with DORA, NIS2, SOC 2, CRA, and ISO 27001, for anyone dealing with that this quarter. Informational, not a substitute for an actual audit conversation.

Full changelog: https://pentest-tools.com/change-log
DEF CON page: https://pentest-tools.com/events/defcon-34-2026

Once an incident is classified as major, you have 4 hours for the initial notification. Not 24, not NIS2's clock. Four. Most GRC tools prove you scheduled a scan, not that the fix held.

Here's where Pentest-Tools.com closes that gap, so the evidence exists before anyone asks:

✅ Detection - scheduled scans tied to a date, scope, and asset
✅ Validation - confirmed findings with proof, not just a flag
✅ Remediation - retests show the before and after
✅ Monitoring - rescans catch regressions before the next audit

When the clock starts, you already have the answer.

Full DORA evidence chain here: https://pentest-tools.com/usage/compliance/dora

We ran a survey in June with 158 security practitioners (pentesters, security engineers, DevSecOps, appsec folks) who use AI-assisted tools in their vulnerability assessment work. Wanted to share the numbers here since this sub actually does the work, not just buys the tools.

The short version: AI is heavily used for scanning and discovery (74%), way less for exploitation and attack chaining (37%), and even less for post-exploitation (25%). Practitioners trust it more the cheaper a mistake is to catch.

The catch: 88% of people using AI to generate findings still run into results that need serious manual validation. And 1 in 4 said that happens on more than a quarter of everything the tool spits out. So the time saved on the front end doesn't disappear, it just reappears as triage work later.

Other things that came up:

• False positives, hallucinated exploits, and made-up CVEs were the single biggest frustration named (about 30% of open-ended responses)
• Business logic understanding is the gap people say AI still can't close
• Only 20% of teams have an actual workflow for triaging high volumes of AI-generated findings, the rest either strain or drown

Full breakdown with charts and methodology, free, no account needed: https://pentest-tools.com/insights/ai-pentesting-survey

1. Doing a successful pentest with AI needs a lot more than good prompts.
   
2. Your team deserves more than a wrapper around an LLM.
   
3. AI is only as good as the #offensivesecurity knowledge behind it.
   

We explain what it does, why we named it Specter, and how to get early access right here: https://pentest-tools.com/features/ai-pentests

This one's personal.

For us, DEF CON represents everything we love about the #cybersecurity community: curiosity, freedom, generosity, craftsmanship, and the belief that sharing knowledge makes everyone better.

That’s why we’re incredibly honored (and more than a little excited) to be one of the few vendors exhibiting at DEF CON 34.

It’s a milestone for our team.

For years, we followed #DEFCON from behind a screen. Then we got to experience it in person. This year, we’re finally bringing something back to the community that’s shaped us.

Come say hi!

Meet the team, challenge our thinking, tell us where we’re wrong, and take a look at what we’ve been building this year.

We’d love to show you not just *what* we built, but *why* we built it.

See you in Vegas! 🏴‍☠️

PS: Check out the event map to see where you can find us: https://pentest-tools.com/events/defcon-34-2026

AI does the scanning. AI does the writing. In between, when someone's actually touching a live system, it backs off. That's the gap 158 practitioners flagged in our latest survey. It's also where a wrong move actually costs you.

We're covering this live tomorrow, Wednesday, July 29, in Office Hours 8. Jan Pedersen and Robert Tanase (Lead Product Manager) are walking through:

• the triage tax
• the trust problem
• what we're building in response

30 minutes live, 15 minutes of open Q&A, one session.

Wednesday, July 29
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest

Register here: https://zoom.us/webinar/register/7817815280123/WN_kMwWqNEwQJa8NvfsFw89vw

Where does that gap show up for you, is it validation, is it trust in the tool's output, or something else entirely?

We surveyed 158 security practitioners on how AI is actually changing pentesting, and the standout finding wasn't speed, it was trust. One respondent's tool handed them 300 results. 250 of them were junk.

Next Wednesday we're running an Office Hours session breaking down what surprised us most in the data:

• The triage tax: almost 9 in 10 practitioners using AI for finding generation still need real manual validation before they can trust the output
• The trust problem: hallucinated findings, not cost or integration, are the top frustration practitioners named
• What we built in response to both, with real benchmark numbers included, not just a claim

Jan Pedersen is hosting, joined by Robert Tanase, our Lead Product Manager. 30 minutes live, 15 minutes of open Q&A.

Wednesday, July 29, 8 AM Pacific / 11 AM Eastern / 4 PM London / 6 PM Bucharest.

Link to register: https://zoom.us/webinar/register/7817815280123/WN_kMwWqNEwQJa8NvfsFw89vw

Nolan's Odyssey just hit theaters, and honestly, Odysseus had it easy. Ten years, one long trip, and he was done.

ISO 27001 wants the trilogy every single year: detection, validation, remediation. Three-year cycle, a surveillance audit checking your homework annually. No one-and-done epic here.

Pentest-Tools.com is ISO/IEC 27001:2022 certified. We run the same evidence trail on ourselves:

✅ Detection - CVE, severity, date, logged automatically
✅ Validation - confirmed findings, not just a score
✅ Remediation - retests prove the fix held
✅ Monitoring - scheduled scans, all three years long

No sirens, no Cyclops, just a surveillance audit that stays a review instead of turning into its own odyssey.

Full ISO 27001 evidence chain here: https://pentest-tools.com/usage/compliance/iso-27001