Pentesters quietly rebuilt their toolstack. Here’s what’s actually in it now.

The phases of a pentest didn't change. What runs each phase did, and knowing exactly where the agents slot in (and where they very much don't) is the whole game in 2026.

If you learned pentesting even three years ago, the methodology you learned is still correct: recon, enumeration, vulnerability discovery, exploitation, post-exploitation, reporting. That structure hasn't moved. What's moved, and moved fast, is what actually executes each phase — and the honest version of "AI changed pentesting" isn't "AI does the pentest now." It's that AI agents have slotted into specific phases, dominated some, barely touched others, and left the highest-value work exactly where it always was.

But no worries, you have me, so let me map it properly.

First, the distinction that matters: copilot vs. agent

A copilot advises. An agent acts — it runs the command, reads the output, and decides what to try next, inside a reason–act–observe loop.

This distinction is the entire reason the toolstack changed, because the new generation of tools don't just suggest the next nmap flag, they run the scan, parse it, and pivot on the result autonomously. Both kinds are now in the stack. Knowing which phases suit which is the skill.

Phase 1 — Recon and enumeration: heavily agentic now

This is where autonomy took over hardest, and rightly so, because the work is high-volume, largely passive, and exactly the tedious grind that used to eat the first day of an engagement.

The classic tools are all still here — nmap for scanning, the standard subdomain and DNS enumeration utilities, certificate-transparency queries, OSINT collection.

What changed is the orchestration layer sitting on top. Agentic frameworks now drive these tools autonomously: a black-box agent takes a domain and runs DNS enumeration, CT log queries, cloud asset discovery, port scanning, and JavaScript bundle analysis on its own, chaining each step off the last and verifying extracted secrets live before reporting them. Multi-agent frameworks integrate dozens of these underlying tools across network, web, AD, OSINT, and cloud categories and let a coordinator decide which to invoke.

Why agents fit here: the actions are mostly read-only, the volume is high, and the decisions ("this port's interesting, fingerprint it") are pattern-driven enough that a reasoning loop handles them well. This phase went from days to hours.

Phase 2 — Vulnerability discovery: agent-assisted, human-steered

Here the tools became reasoning layers rather than pure scanners. The shift is from deterministic, signature-based scanning to tools that reason about an application's behavior and chain vulnerabilities together.

On the reasoning side, tools like PentestGPT matured from research project into a genuinely useful layer that sits on top of your existing toolchain — you feed it your nmap output, your Burp findings, your enumeration logs, and it parses the context, suggests the next logical attack path with reasoning attached, and tracks the test tree so you don't lose the thread mid-engagement.

On the code side, LLM-powered static analysis tools like VulnHuntr trace user input through to dangerous sinks across a whole codebase and have genuinely found real zero-days in large open-source projects.

Burp Suite is still here, still central, now paired with custom AI-driven HTTP fuzzers for the underlying API surfaces. OWASP ZAP, StackHawk, and the rest of the DAST layer still run — the AI tools orchestrate around them rather than replacing them.

Why humans stay in this phase: the tools produce candidates. Deciding which candidates are real, and which combinations matter, is still judgment that only humans can provide.

Phase 3 — Exploitation: the agentic frontier, and the most gated

This is where "automation" became "autonomy" in the marketing, and where you need to read carefully. The genuinely new capability is the feedback loop applied to exploitation: an agent generates a payload, sends it, analyzes the resulting error, refines the payload based on that error, and retries until it works.

Web-application-focused platforms have gotten legitimately good at this for known vulnerability classes on web targets specifically, with deterministic validation to keep false positives low.

But, and every serious source agrees on this — no serious tool operates fully autonomously without oversight. The best ones present findings with proof-of-concept exploits and then hand off to a human to validate, prioritize, and expand. The agent handles volume; the human adds the judgment and context the agent lacks. Autonomous exploitation is real, it's constrained to well-understood vulnerability classes on well-understood target types, and it's supervised.

Phase 4 — Post-exploitation: still mostly human

Notably under-automated, and for a good reason. Post-exploitation — lateral movement, privilege escalation, understanding what a foothold actually means in this environment — depends heavily on context specific to the target that agents don't have. Tools like Pentera automate parts of internal network validation, AD attack-path discovery, and credential validation, and that's genuinely useful. But the creative, context-dependent core of post-exploitation remains a human doing what humans are still better at: reasoning about a specific environment's specific weaknesses.

Phase 5 — Reporting: quietly transformed, barely discussed

The least glamorous, most universally adopted change. AI now drafts findings, writes up reproduction steps, and generates the tailored summaries — the technical version, the executive version, the remediation guidance — from the raw engagement data. This reclaimed an enormous amount of time that used to be spent writing rather than testing, and almost nobody talks about it because it's not exciting. It's also one of the highest actual-productivity wins in the whole shift.

A special note: pentesting the AI itself is now its own phase

Worth flagging because it's genuinely new. Testing AI agents and LLM-integrated apps is now a distinct discipline with its own stack — Garak for baseline LLM vulnerability scanning, PyRIT for adversarial prompt generation, promptfoo for prompt-vulnerability regression testing, plus Burp for the underlying API surface. Testing an AI agent means testing layers a web app doesn't have: the planning layer, the tool-calling layer, and the memory layer. If your target is an agent, your stack looks different.

The through-line

Map the change and a clear pattern emerges: agents dominated the phases that are high-volume and pattern-driven (recon, reporting), assisted heavily in the phases that mix volume with judgment (discovery, exploitation), and barely touched the phases that are mostly context and creativity (post-exploitation, novel logic flaws).

That's not a coincidence, it's exactly the boundary of what these systems do well, showing up cleanly in which parts of the job they took over and which they left alone.

The tooling got dramatically more capable. The thing that makes someone a good pentester — understanding what a system is supposed to do and finding where it can be made to do something else — didn't get automated.

It just got a very fast, very tireless research assistant, and moved up the value chain to where it was always most useful.

Would you like me to share the exact methodology I use now?