100%of discoverable vulnerabilities
- 30% autonomously discoverable via SAST/DAST
- 70% required manual analysis
Automation covered only a fraction of discoverable vulnerabilities.
©2026 · Manifesto Vultus
A manifesto for the era of autonomous attacks
Digital security has entered a new era. Organizations are expanding their attack surfaces exponentially, while attackers already use AI to exploit vulnerabilities faster, at lower cost and on a much larger scale.
New era
What once required time, context and budget is now being uncovered by autonomous systems.
Using AI to accelerate business is essential. The side effect is a growing digital surface. Applications, APIs, integrations, credentials, permissions and workflows accumulate risks that have not always been identified, validated or prioritized.
Generative AI has made an increasing share of offensive discovery autonomous. Systems can already inspect applications, compare responses, test hypotheses, probe workflows and build attack paths like an advanced adversary.
Companies' attack surfaces did not necessarily get worse overnight. But they have become more visible and exposed than ever.
There is a short window to adapt. Long-term digital resilience requires strategies that combine continuous autonomous testing, AI adoption governance and hybrid adversarial simulation.
Autonomous coverage
In 2026, autonomous discovery moves beyond SAST/DAST.
100%of discoverable vulnerabilities
- 30% autonomously via SAST/DAST
- 45% now autonomously discoverable with GenAI
- 25% still require manual analysis
GenAI sharply narrows the gap between what can be discovered and what can be discovered autonomously.
The share left for fully manual analysis becomes significantly smaller.
Adaptation
Three principles now underpin defense.
Continuous autonomous testing
One-off assessments and annual schedules leave gaps that are too large. Testing needs greater frequency, technical depth and the capacity to address what it uncovers.
Continuous AI governance
AI adoption, software deployments and internet-facing expansion need to be tracked as direct drivers of attack-surface growth.
Hybrid adversarial simulation
If the adversary is a person using generative AI, simulation needs to be hybrid too: machines for scale, people for direction, limits and impact.
Principles of autonomous testing
The goal should not be more tickets, but clearer attack paths.
Ahead of the adversary
The priority is to find attack paths already present in the organization's digital surface before someone exploits them.
The false sense of safety is over
Risk rises when an old flaw becomes easy to find. GenAI has lowered the cost of offensive investigation.
Live systems
Application testing must account for users, permissions, business rules, APIs, errors, integrations and exceptions.
From exposure to impact
Testing needs to show a path: exposure, exploitation, impact and remediation, not just an isolated list of vulnerabilities.
#AIFirst + #InternetFacingFirst
The new approach prioritizes what can be automated and what is exposed to the internet.
Scanners are still useful
But they are not enough. Static patterns and plugins still uncover vulnerabilities, but the next frontier calls for hypotheses and exploitation.
People remain essential
Pentesters and red teamers provide direction, validate impact, enforce limits and turn findings into decisions.
Executive view
Boards, executives and CISOs need answers: what is exposed, how could it be abused, what would the impact be, and what should be fixed first?
The era when vulnerabilities stayed hidden because finding them cost too much is over. GenAI has brought down the cost of offensive discovery.
Every surface will be attacked.