For those who have trialed an AI pentest solution: what was the single biggest gap you encountered?

From my experience, the biggest gap with AI-driven pentest tools is depth of context. They’re good at scanning broad attack surfaces quickly, but they often miss nuanced issues—like business logic flaws, privilege escalation paths, or chained exploits across systems. Without human creativity to connect the dots, results risk being shallow. The question is how to best blend AI speed with human expertise for meaningful coverage.

Sometimes, they need more environmental context to target the right APIs and instances.