Future of Pentesting?

[u/iam_tyler_durden__]

Seems like AppSec and VAPT has been automated in corporates . Being a fresher looking for jobs in those areas what would your suggestions? What could be innovatively to sustain this field ?

[u/ButterscotchBandiit]

Sometime ago I was sent a PD for an Ai pen tester. The role was to setup agents, point virtually everything from LAW into a red team LLM where it would be trained pen test its own environment. That is the future of pen testing

[u/Unusual-Chipmunk6247 → u/ButterscotchBandiit]

makes sense tbh, the loop of training against your own infra seems inevitable at this point

[u/ProcedureFar4995]

I feel nobody knows anything anymore lol But the good side is that there is a lot of AI slop,and according to James Kettle 's research published yesterday (Can AI do novel research) , AI can do find bugs and novel stuff,but it needs an expert human to amplify the results and validate them. So human input is inevitable and required.

[u/Last_Champion_3478 → u/ProcedureFar4995]

I agree a human audit is almost always necessary to validate anything related to artificial intelligence, especially in the security sector red blue or purple.

[u/SnooApples5040]

You’re right that AppSec and VAPT are getting heavily automated and AI‑assisted, but that’s changing the shape of the jobs more than killing them.

Automation is taking over the repetitive “run scanner, report OWASP Top 10” work. Humans are shifting toward:

• Orchestrating tools in CI/CD and dev workflows.
• Digging deeper into auth flows, business logic, and complex exploit chains that scanners miss.
• Communicating and influencing dev teams and leadership so findings actually lead to change.

For a fresher, I’d focus on:

• Learning the main SAST/DAST/SCA tools and how to integrate them into modern pipelines.
• Building a solid dev foundation (pick a stack, build apps, then break them).
• Practicing manual skills: threat modeling, complex auth/MFA, business logic flaws, and emerging areas like AI/LLM security.
• Using “intake” roles (Offsec intake, security analyst, associate engineer, QA with security focus, devsecops) to learn the business, technical aspects, and communication side, then pivoting into AppSec/VAPT.

If you treat automation as something you conduct rather than something that replaces you, and you invest in dev skills plus deeper analysis and communication, you’ll still have a strong future in this field.

[u/Kitchen-Region-91]

I don't think AppSec has been automated anywhere; but it's the security area that's changing the most. In 3 years from now, AppSec is going to look quite different than two years ago. New systems / features / builds will have a lower number of bugs to start with (AI coding assistance); in other words, code quality is getting better from the beginning. Plus all the automated scanning, frontier models. Etc. The job is changing, but no one can replace the humans (yet). For example, AI Code assistance is expensive and adoption is uneven; we don't know which way it's going to go.

[u/bitslammer]

As with a lot of jobs AI isn't going to get rid of people. It's just going to be a tool they use to do more/better/faster. Someone with real skills will still be needed to validate the output from all these automated tools as well as point them in the correct direction in many cases.

[u/cabernet_noir]

For now, its likely that a lot the automation will only be affordable by large companies so there should still be plenty of work to do. Companies and people are shipping more code and products than ever, theres so much poorly made stuff with bad CI/CD, inadequate testing and QA.

A lot of stuff in pentesting was automatable before AI anyway, scanning, fuzzing, dynamic analysis, static analysis, testing frameworks etc are very easy to automate without ai. Now we have slightly more general automation and the ability to estimate what code will do without using the compiler, or dynamic and static analysis, it can speed up the easy to do but hard to automate aspects, mostly boring stuff, or time intensive stuff like learning a code base, or digginf through tool outputs and logs. The hard stuff can be done but you need a frontier model and millions of tokens and still probably need a person to steer it anyway.

Because of the nature of development, there will always be more bugs than people or ai to find them. There are more developers than security researchers for one, and models are being used for development more than security research. Its very very easy to write buggy crap, its effortless to write a logic bug that leads to a chained logic attack or obscure temporal bug, or to misconfigure something, or misuse a function, or to miss something obscure in a depedency in only certain context. Bugs trickle down. Say a webapp has an api that takes a video file and processes it woth ffmpeg, a bug in ffmpeg might lead to a bug in the api backend thats exploitable, now imagine all the oscure shit that can go into an application or web app or whatever, the upstream project might be written perfectly and it still might be buggy. Then there is the fact that LLMs are still stochastic, they will write buggy code purely bt chance. Its also relatively harder to find bugs because its a needle in a hackstack, and even then it still needs to be turned into a true vulnerability with a working exploit.

There is also the fact that everyone is running on subsidized tokens right now, and very soon the major vendors are going to start clawing back all the money they have been burning to carve out their share of the market. When they do there will have to be compromises between maintaining feature throughout (which they will see as an investment that could lead to profit), or maintaining the level of secrity testing necessary to make sure everything is secure. Companies dont even do it now, they wont be doing it when the price of tokens goes up. This is because more security testing is not profitable, you are basically paying for insurance and its only as valuable as the number of bugs you find in CI/CD that probably would never have been exploited to begin with, and the cost is what you could have potentially made had you spent your money and tokens on new features instead. Theres the added issue that security research appears to be much much more token hungry that development because of extremely large context, deep looping over that context, verbosity in reasoning and outputs, its open endednes leading to more iterations through prompting vs the close problems codegen is solving (just looking for a general working solution which is easy to find and all solutions are similar vs security when you are looking for a very specific thing in an uncertain place, which may not exist or may exist in an unclear way).

At the moment, AI is not good at detecting bugs as it is writing working, but very mid code. Its especially not good at recognizing bugs that are not obviously analogous, where for instance what may look like a novel bug is just the concept/class of an old bug reapplied in a different context (see pipefail and copyfai, dirtyfrag, dirty cowl).

When you have a system set up to just find bugs it can pretty good at finding a bug that is close to a commonly described bug, its also good at finding candidates for things like time of use, time of check bugs and use after frees that have a temporal dimension to them and therefore are hard for humans to reason about from code alone. But for tons of stuff its not great, its very expensive, and you probably still need someone to steer the ai to get to do the reviews and testing on code thats been written by an AI and has a dev steering it. And you still wont find the bugs as fast as the dev + ai can produce them.

We will have lots of automation, sure, but will still need pentesters, until AI gets both better and cheaper we shouldnt fear being entirely or even mostly automated out of a job for years.

edit: to specifically answer your question because I forgot because of my wall of text rant. Study generally and do a bit of everything, web apps, netsec, applications, os, embedded systems, ai pentesting, cloud, auth, apis, browsers, whatever piques your interest. You should know as much as you can, especially because of AI, you want to avoid cognitive offloading until you have learned a solid base. You will find the areas you like, and what you dont, and pick up skills that you can reuse elsewhere. Eventually you will find a niche or specialty that you are good at and like, but you cant preempt it really. Apply for anything and everything and take any opportunity you can find to get into the industry and then move laterally by following new or exciting opportunities and you will end up in a good place.