Automated Pentesting and AEV Tools Compared: 10 Platforms in 2026

Gartner's Adversarial Exposure Validation (AEV) category covers technologies that "confirm how potential attack techniques would successfully exploit an organization and circumvent prevention and detection security controls". Inside it, four different mechanisms are on sale:

• Scripted pentest automation

  Software runs the steps a consultant would, discovery, enumeration, known exploits, credential attacks, lateral movement, in a fixed sequence. Repeatable and affordable, limited to what its authors encoded. vPenTest is the clearest example.

• Breach and attack simulation (BAS)

  A catalog of known techniques is replayed against your controls to see whether the email gateway, WAF, EDR or SIEM stops or detects them. It answers "would we catch this?", not "can someone get in?". Cymulate, Picus and Pikered start here.

• Attack-path modeling

  A graph of identities, hosts and permissions shows which chains could reach critical assets and where the choke points are. It models viability rather than proving it. XM Cyber is the reference.

• Autonomous AI agents

  Models read what they find, form a hypothesis and choose or write the next action, including exploit code for that specific target. They can reach chains nobody scripted, which also makes human control essential. XBOW, Horizon3.ai NodeZero and Zero Hunt are built this way, with different scopes and delivery.

Most vendors now add agentic features on top of their original family, so read the mechanism, not the label.

• Pentera

  The largest automated security validation vendor by reported revenue (passed $100M ARR in January 2026, vendor figure). Core installs on your own infrastructure; Surface, for the external perimeter, is hosted on AWS; generative-AI features call Amazon Bedrock. Strong technique breadth and a documented DORA TLPT methodology. No fully air-gapped operation documented.

• Horizon3.ai NodeZero

  Autonomous pentesting with proof of the actual attack path. Packages on its pricing page: Flex (episodic), Core (continuous), Pro and Elite, plus web-app add-ons. FedRAMP High authorized; EU-hosted portal. The customer-hosted runner needs outbound access to Horizon3's cloud during a test, and no air-gapped edition is documented.

• XBOW

  An autonomous pentester for web apps and APIs that writes and runs its own exploits and validates each finding with a proof of concept; first AI system to reach No. 1 on HackerOne's US leaderboard (June 2025). SaaS on third-party frontier models, usage-based pricing through cloud marketplaces. Not built for the internal network.

• Cymulate

  Established BAS, now "AI-powered exposure validation", with 100,000+ attack actions updated daily (vendor figure) and fast SaaS onboarding. Lightweight test points run on your network; the platform and its AI run in Cymulate's cloud on OpenAI models.

• Picus

  BAS and AEV platform with six validation modules and an agentic layer (Picus Swarm, Numi AI). Strongest at security-control and detection-rule validation, telling you whether SIEM and EDR rules fire. Documents SaaS, on-premises and air-gapped deployment.

• XM Cyber

  Continuous attack-path modeling across hybrid cloud, with choke points ranked by impact and, since 2026, low-impact active tests in a digital twin. SaaS by default with EU hosting and BSI C5; no fully on-prem or air-gapped edition documented.

• RidgeBot (Ridge Security)

  Agentless automated pentest that exploits with real proof-of-concept code from a 36,000+ plugin library, across network, web, API, Active Directory and OT/IoT discovery. Ships as an on-prem software appliance or on AWS and Azure Marketplace. Its separate agentic product, RidgeGen, brings your own LLM.

• vPenTest (Vonahi Security, a Kaseya company)

  SaaS that scripts a consultant's internal and external network methodology and returns a human-QA'd report in about two business days, sold mainly through MSPs. AI is limited to the executive summary; the internal agent must reach Vonahi's cloud.

• Pikered ZAIUX Evo

  Italian agentless cloud platform that runs a stealthy command-and-control chain against Active Directory and Entra ID and measures SOC and EDR response, with NIS2 and DORA reports in 24 hours. Named a representative vendor in Gartner's 2026 AEV Market Guide; ACN QC1 qualification for Italian public administration. Full cloud SaaS.

• Zero Hunt

  An on-premise appliance running an autonomous AI red team on its own models: agents write exploit code per target across the internal network, Active Directory, web, API and OT/ICS, with traffic analysis and compliance mapping to 34 frameworks in the same box. A younger product than the others on this list, not named by Gartner, with no public benchmark yet.

A pentest feeds the tool the most sensitive map of your estate: hostnames, credentials it recovered, the paths that worked. When the model that drives the test runs in a vendor or third-party cloud, that map is processed there.

The public documentation shows four arrangements:

• Third-party frontier models in the vendor's cloud. XBOW (frontier models), Cymulate (OpenAI models in an AWS tenant), Pentera's generative features (Amazon Bedrock).
• Vendor cloud orchestration with a runner on your network. Horizon3.ai NodeZero, vPenTest.
• Bring your own model. RidgeGen lets you point the agents at a self-hosted model or a frontier API.
• Models on hardware you own. Zero Hunt runs its models on the appliance; Picus documents on-prem and air-gapped deployment of its platform.

This matters for three reasons buyers raise in 2026: data-residency and sovereignty rules in regulated sectors and government, the risk that a rented model is restricted, withdrawn or changed by its provider, and cost, since agentic testing on metered frontier models is billed per use while a model you own runs at a flat cost.

Use these in the demo, on your own scope, not on the vendor's lab:

1. 1Show me one finding end to end. The exploit or request that was sent, the response, and what was done after access. A severity score or a screenshot of a dashboard is not proof.
2. 2Was the exploit written for this target or taken from a library? Both are legitimate; a library cannot reach chains nobody has catalogued.
3. 3What happens when the technique is blocked? A BAS result that says "blocked" proves that one technique failed, not that the asset is safe.
4. 4Which actions wait for a human? Ask for the list per autonomy level, whether it can be set per campaign, and whether every approval is logged with a name and a time.
5. 5Where does the model that plans the test run, and which model is it? Ask what data reaches it.
6. 6Can it run with no internet connection at all? If yes, ask what stops working in that mode.
7. 7How is the evidence protected? Can an auditor verify that a record was not edited after the test?
8. 8How is a fix retested? Same exploit, same evidence, on demand.
9. 9What is your false-positive policy, and who checks it? Automated triage, human QA, or both.
10. 10Is there an independent, blind measurement of your exploitation rate? Vendor-run results on public challenge sets are not blind.

The tools overlap less than the marketing suggests, and many enterprises run two.

• "Would our controls catch this technique?" BAS: Cymulate, Picus, Pikered. Picus is the strongest on detection-rule tuning.
• "Which identity paths reach our crown jewels?" Attack-path modeling: XM Cyber.
• "Can someone get in from the internet through our web apps and APIs?" XBOW, or NodeZero's web add-ons.
• "Can an attacker inside the network reach domain admin, and how?" Autonomous or automated internal pentest: NodeZero, Pentera Core, RidgeBot, vPenTest, Zero Hunt.
• "Recurring network pentests for many small clients." vPenTest, built for MSPs.
• "Nothing may leave the perimeter, or the network is air-gapped." Platforms that document on-prem and air-gapped operation: Picus for BAS, Zero Hunt for autonomous pentesting; RidgeBot installs on-prem.

For regulated testing, check what the regulator accepts: DORA TLPT and CBEST require external, threat-led testers, and automated tools support that work between exercises rather than replacing it.

Zero Hunt is built for the last two rows above: internal estates, OT/ICS and sectors where test data and the model that drives the test have to stay on hardware the customer owns. The appliance runs its own models locally; agents write exploit code per target in black-box or gray-box mode; the operator chooses one of five autonomy levels, which set the actions that wait for human approval; evidence records are Ed25519-signed and hash-chained so an auditor can check they were not altered; findings map to 34 frameworks worldwide, from NIS2 and DORA to PCI DSS, HIPAA and NCA ECC. In air-gapped mode it uses no public OSINT or public source downloads, so it tests black-box only.

Where others are stronger today: Picus on detection-rule validation, Cymulate on breadth of control-validation content, XM Cyber on identity attack-path graphs, XBOW on public proof for internet-facing web apps, Pentera and Horizon3.ai on market maturity and customer base. Zero Hunt is newer than all of them and publishes no benchmark numbers yet; ask us to run the questions above on your scope instead.