From the annual pentest to continuous security testing
By Ralf Schmidt | 29 September 2026 | Tech Corner
An application is tested today. Three weeks later the next release follows. New features, changed permissions or additional interfaces may already have changed the security posture again.
The classic penetration test only partly solves this problem: it delivers a qualified snapshot.
This is exactly where AigentX by KomodoSec comes in. The platform is designed to run security tests repeatedly, for example before a release, after a vulnerability has been fixed, at scheduled times or on demand.
For mid-sized companies, the buzzword "AI" is less interesting here. What matters is a different question:
Can the one-off pentest become a continuous security process?
More than an automated vulnerability scan
Automated security scanners are nothing new. AigentX aims further.
According to KomodoSec, the platform reconstructs how an application actually works. Services, workflows, roles and their relationships are captured from the application's behaviour. The system can register accounts, authenticate and create the objects needed for deeper security tests.
Particularly interesting is the testing of different identities and permissions. AigentX compares which functions different users, roles or tenants can actually reach and execute. The system thus explicitly addresses vulnerabilities in authorisation and business logic.
The difference therefore lies in the question being asked.
While classic automated checks identify technical vulnerabilities, the agentic approach of AigentX aims to examine applications in the context of their actual workflows.
Or, put simply:
Not only: "Which vulnerability might exist?" but also: "Which unintended action can actually be performed within a real business process?"
"Agentic" in this context means that the system does not merely work through a rigid test sequence, but performs actions, executes workflows and reacts to the application's behaviour within defined boundaries.
From potential vulnerabilities to validated findings
Another important point is validation.
KomodoSec describes AigentX as confirming the exploitability of a vulnerability before it is reported as a finding. The reports shown include executive context, findings by severity, attack paths, technical evidence, reproduction and remediation information, and retests.
This matters for practical work.
Security and development teams need more than hints about possible vulnerabilities; they need information that is as concrete as possible on how a problem can be reproduced and then fixed.
This is exactly where the AigentX approach comes in: the results are not meant to be merely a list of candidates for further analysis, but validated findings with attack path and evidence.
Why this is particularly interesting for the Mittelstand
Mid-sized companies, too, increasingly operate business-critical customer portals, web applications, APIs and digital business processes.
This expands the attack surface to be protected, while the question arises of how often an organisation can afford high-quality offensive security testing and organise it internally.
This is where the particular potential of an approach like AigentX lies: using penetration testing more often and closer to the development and operations process.
According to KomodoSec, the platform supports various recurring modes of use, including targeted retests after remediation, scheduled assessments and tests on demand. In a retest, the original attack path can be checked again.
This creates a different security logic:
Test → Fix → Validate again
And whenever relevant changes occur, the cycle starts again.
This is especially significant for the Mittelstand. Instead of viewing penetration testing solely as an isolated project, it can in future be linked more closely to the ongoing development of business-critical applications.
Autonomous pentesting needs clear boundaries
The more autonomously a security system acts, the more important control over what it is allowed to do becomes.
This applies to offensive security in particular.
With AigentX, scope, exclusions, identities used and the permitted test intensity are therefore defined, among other things. KomodoSec also describes internal safety mechanisms. An exploit is accordingly only executed as far as necessary for proof. Unnecessary changes or deletion of existing data are to be avoided and system availability protected, unless destructive testing has been authorised.
For companies, this governance is not a side feature.
It is a prerequisite for the controlled use of autonomous offensive security testing.
Especially for business-critical applications, it must be defined which systems are tested, which areas are explicitly excluded and how far a test may go.
Here AigentX combines autonomy with defined Rules of Engagement.
Agentic pentesting and human expertise
The strength of AigentX does not lie in replacing human security expertise. The decisive progress is being able to perform high-quality offensive security testing more often, repeatably and closer to the ongoing software lifecycle.
AigentX is designed to understand applications and their actual workflows, test different identities and permissions and validate the exploitability of vulnerabilities found. After a fix, the original attack path can be checked again. A single assessment thus becomes a repeatable process of test, remediation and retest.
Particularly interesting for mid-sized companies is the combination of automation and human expertise.
KomodoSec offers AigentX both as a self-managed solution and in a managed model. In the managed model, AigentX performs the assessment. KomodoSec penetration testers then review and validate the findings before delivery.
So it is not about "AI or security expert", but about combining both capabilities: agentic technology provides scalability and repeatability, human expertise complements it where professional judgement is needed.
For mid-sized companies in particular, this approach opens up the possibility of establishing penetration testing as a continuous part of their own cybersecurity, instead of having the security of business-critical applications checked only at individual points in time.
From security test to security process
AigentX is interesting above all because the platform makes a fundamental development in penetration testing visible:
Offensive security does not necessarily have to remain a one-off project.
If applications can be re-tested after releases, after remediation, at scheduled times or on demand, penetration testing moves closer to the ongoing software lifecycle. According to KomodoSec, AigentX is designed precisely for such repeatable assessments.
For the Mittelstand, this is a key benefit of agentic penetration testing: not replacing security experts, but making offensive security testing more scalable, more repeatable and thus more continuously available.
The real change therefore does not lie in a new technology alone. It lies in the opportunity to rethink penetration testing.