How AI Will Change Cybersecurity Consultancy
Prologue
I built an AI workflow and pointed it at the platform we use to assess security candidates. Less than an hour later, it had found every vulnerability. Turns out we may need to start interviewing agents.
The platform contains eight vulnerabilities, from cross-site scripting (XSS) to remote code execution (RCE). Candidates get two hours to find as many as they can; most identify four to six. The workflow found all eight in under an hour. Total cost: roughly 80 SEK, about eight dollars.
I demoed the workflow to my colleagues. First came the collective sigh. Then came the job searches.
This result is not an anomaly. Microsoft, Cloudflare, XBOW, Truesec, and others have already demonstrated that AI agents can probe, identify, test, and exploit security vulnerabilities.
The immediate effect of this technology is faster vulnerability discovery. The more consequential question, however, is what happens when both consultancies and their customers can use the same capability? Routine testing will become customer-operated, while consultancies will compete on tailored workflows, validation, and proven results.
Terminology
Throughout this article, “workflow” and “pipeline” mean the system around the agents, not merely the model. “Agentic security” is that system applied to security work.
AI Agents in Penetration Testing
Agentic workflows are becoming a core capability and component in the modern tool-box for penetration testers. Typically, your understanding and number of findings in a system grows as you approach the end of the assignment. In white-box security assessments, you can leverage AI workflows to understand large codebases and identify security leads faster.
The consultancy question: does faster mean more assignments?
No, at least not if the goal is to deliver better work rather than more reports.
AI workflows in penetration testing and vulnerability discovery can be used in two ways:
- Autonomous AI Workflow: Your AI agents work independently to uncover security vulnerabilities, with no human oversight. AI leads the engagement.
- AI Augmented Operator: The human operator work in collaboration with a number of AI agents. AI powered, Human led.
Autonomy makes assignments scalable, at least mechanically. Buy more compute, run more engagements. Compute is the easy part, the hard problem is proving that the output is trustworthy and consistently deliver value.
Under the autonomous workflow you can deliver more assignments, but the consultant still remains accountable for the engagement, authorization, scope, evidence review, escalation, and customer sign-off. Additionally, the output depends on the quality and expertise of the underlying system driving the workflow.
If the system has not been evaluated in attacking different tech stacks or verified to produce quality with various AI models—then the system is based on guesswork rather than systematic quality assurance. Moreover, putting aside AI hallucination and prompt injection—what type of vulnerability classes can the workflow identify? Do you know?
The second option augments the existing security professional with AI capabilities, merging the artificial intelligence with the human intelligence. In this setup, the AI agents have access to the same context as the human, such as credentials, tech stack, authenticated requests, HTTP history and more. This allows the AI agent to collaboratively work on tasks with the human because it has access to the same information.
The augmented operator on the other hand, will carry out the assignment like before, but leverage AI workflows and agents. The operator can discover more security findings and provide better recommendations during the same time-window. Why reduce the booked time to fit more assignments, when you can provide your customers with more value instead?
It should be noted that, the success of the augmented operator depends on their skill to use AI effectively. But this advantage will not remain exclusive to penetration testers. The same types of agents and workflows are rapidly becoming available to the development teams that consultancies are hired to assess.
Democratizing Software Development and Security Agents
It is not only cybersecurity professionals who can benefit from agentic security—customers can use similar agents and workflows in their development environment and identify the same security vulnerabilities as professional penetration testers. There is already a vast amount of “AI-Hack Bots” or “AI-Pentest” projects on Github.com, and companies are providing free agentic security workflows that their users can use in their codebases.
I suspect that in the future, all development organizations and teams will have security agents in their Software Development Life Cycle (SDLC). As agents become more responsible for developing and testing code, it’s only natural to also define agents that look for security vulnerabilities. And we know that agents can do this work.
This is great for customers, but what does it mean for cybersecurity consultants? The answer depends on the type of vulnerability in question. AI will not affect every part of the vulnerability landscape equally, yet.
The Pyramid of Complexity
When development teams start using security agents in their own coding agents, the majority of typical vulnerability classes such as Injections and Access Control, will be less likely end up in production. But this does not cover every vulnerability class (yet), and the shape of a vulnerability may differ between systems.
If we visualize the vulnerability landscape as a pyramid:
The bottom of the pyramid is all of the OWASP Top 10 and typical vulnerabilities: broken access control, IDOR, XSS, injections, and many others.
The middle of the pyramid cover more complex vulnerabilities such as logic issues, integrations between services, system architecture, and context that a terminal agent might not have access to during runtime. You will need more than the default coding agent.
You will need a custom pipeline, an extra layer of context above the default coding agent that include: system architecture, debug information and dynamic access to the system. This requires agentic- and context engineering. These are not trivial problems to solve.
Depending on the size and interconnections of the system in scope—most customers will not be able to find issues in this part of the pyramid.
The top of the pyramid, you are dealing with low-level and complex issues that require deep expertise and understanding of a given subject. In order to discover vulnerabilities in this part of the pyramid using AI, a strong understanding of agentic engineering and vulnerability research is required.
The question is: how far are we from having an agentic system that can operate at the top of the pyramid without human expertise for guidance or course correction?
Customers Will Run the Agents Themselves
Development teams using security agents together in their coding agents, such as Claude Code, will greatly reduce if not eliminate the bottom of the pyramid. To tackle the middle of the pyramid, development teams will need to spend more time in building custom agentic security workflows and managing context for their agents. Most teams will likely not spend their time building this capability, but it is possible.
To operate in the top of the pyramid, well tuned AI workflows are not enough, you also need technical expertise and experience to guide the agents and help them to achieve their goal. This is where the role of the consultancy changes: not because customers will stop needing security expertise, but because the expertise they need will shift away from routine vulnerability discovery.
Future Moat in Cybersecurity Consultancy
The pyramid tells us one thing: over time, customers will be able to identify security vulnerabilities themselves, perform mitigation and remediation using agents.
For cybersecurity consultants, this means the end of OWASP Top 10 vulnerabilities, assuming the customers’ agents work. Moreover, customer will begin questioning why they should pay 100,000–300,000 SEK (10k–30k USD) for a penetration test, when they can identify and even remediate vulnerabilities themselves.
However, there will be customers who don’t know what vulnerability classes to cover and what agentic security frameworks/harnesses to build upon, or how to use security agents effectively. Moreover, can the customer verify that an agent’s patch removes the vulnerability without introducing a new one?
The future moat will not be selling offensive expertise—it will be selling agentic capability powered by offensive expertise.
Where the Market Already Is
When Anthropic released Mythos, CISOs across the world cried in desperation, and threw large duffelbags with cash towards cybersecurity vendors, asking for help to become “Mythos ready”.
For those who don’t know what Mythos is, it was Anthropic’s latest flagship model, said to be extremely capable in the cybersecurity domain. Therefore, Anthropic only released the model to a select organisations to help them secure their software, before threat actors do.
Trust me, mythos was a blessing and a curse—on one hand, the board of a company suddenly realized the importance of security testing, and all of a sudden there was money on the table. On the other hand, the money was spent on the wrong things.
However, in the storm of despair, brought fourth by the mythical Mythos, was a light. More and more vendors, professionals, and bug bounty hunters, released articles about their internal tooling that leveraged a custom harness to identify security vulnerabilities.
The agentic security community showed everybody that the model is not what defines the system, it is the surrounding components and underlying orchestration layer, the harness, that defines the system. You don’t need Mythos to find (complex) vulnerabilities, what you need is a specialized agentic security workflow that facilitates for the AI to scout, hypothesize, identify and verify vulnerabilities.
Both Microsoft and Cloudflare showed that a model without an efficient harness will not be as capable.
The market slowly but surely converged on the idea that a single AI model is not enough. It’s the harness that provides tools, environment, context and memory—that enables a strong security model to perform.
Vercel and VISA have released their internal agentic security harness as open source, and several other vendors and professionals have done the same.
It is clear that the cybersecurity community is investing time and tokens into building an effective agentic security harness. What will differentiate an open source security harness from a closed source harness by a cybersecurity consultancy—is trust and measured results.
Repositioning: Selling Capability and Trust, Not Snapshots
If routine testing with agents becomes easier for customers to perform themselves, a consultancy cannot rely on selling isolated reports alone. Its offering must become the capability to find, validate, and continuously address the risks customers cannot reliably cover on their own. The offer becomes tailored context, workflow design, independent validation, measured capability, prioritisation, and ongoing support.
In the age of agentic security, consultancies will eventually be required to move from snapshot based penetration testing to providing enhanced AI security agents that runs continuously. To accomplish this, a new set of skills are required.
Competency
If there is one skill cybersecurity consultants will need to learn between 2026–2027, its building agentic workflows, context management and how to measure the success of an agent.
Consultants must understand the importance of measuring agentic workflows to confidently inform customers that their workflow consistently identify security vulnerabilities across different tech stacks.
For consultants performing web penetration testing, will need to—in my opinion—work closer to application security. It might sound as a surprise, but not everyone performing web application penetration testing understand application security. Instead, they probe web applications for behaviors corresponding to a vulnerability.
In the context of consultancy and customers, I believe agents will be more useful with access to source code, compared to agents dynamically testing a web application. Of course dynamic testing is useful, but white-box testing will provide far more coverage.
In 2022, I wrote:
The future of application security will not be dynamic or static analysis, it will be context driven analysis.
Agentic workflows is the mechanism that finally makes context-driven analysis scalable.
The graph below shows the future cybersecurity consultant. You can swap out the Application Security stack to your preferred domain, e.g. Active Directory or iOS Security. The context layer builds upon the context in your domain.
Conclusion
When my workflow found all eight vulnerabilities in less than an hour, I jokingly said that we should hire the agent.
The future is that every serious security professional will work alongside agents, and every serious development team will too.
In the next two years, cybersecurity consultants can’t only rely on offensive experience and skill. In my opinion, they will need to develop skills that overlap with an AI Engineer.
Cybersecurity consultants do not have to become full-time engineers, but as security practitioners, it is important to understand the underlying components that help or prevent an AI to identify vulnerabilities.
The question for cybersecurity consultancies is not whether AI can find vulnerabilities. It already can. The question is whether we can build systems that find the vulnerabilities that matter, prove that they work, and help customers act on the results.
The consultants who can do that will not be replaced by the agents. They will be the people customers need to make the agents useful.