Will AI replace penetration testers?

Much of the work, but not all of it. AI could take on about 70% of the working time in a typical penetration tester job today. The other 30% still needs a person.

30% of the work still needs a person.

Needs a person: 30%A person checking AI: 32%AI alone: 38%

The bracket under the bar is the evidence range for the share AI could take on: 48 to 70%. One end comes from how well AI did each responsibility in real use, or a second rating where that isn't measured. The other is our figure, which also follows research across the industry.

21 responsibilities in a typical penetration tester job. Median pay $116,580 a year in the U.S. (BLS, May 2025).

Still needs a person

  • Discuss security fixes with IT teams
  • Attempt to break into systems AI helps
  • Find security weaknesses with pen tests AI helps
  • Evaluate vulnerability assessments AI helps
  • Gather intelligence on vulnerabilities AI helps
  • Develop penetration testing processes AI helps

AI can do or help with

  • Find security weaknesses with pen tests AI helps
  • Track new hacking trends AI helps
  • Gather intelligence on vulnerabilities AI helps
  • Identify new threat actor techniques AI helps
  • Document penetration test findings AI helps
  • Learn new testing tools and methods AI helps

The biggest responsibilities on each side, ranked by a person's time on the left. "AI helps" means AI takes on part of the work, or most of it with a person checking what it produces, so one can show on both sides. See all 21, with the reason for each and the cost of handing them to AI.

Is this your job?

Upload your résumé to see your Human Edge: how much of this job your experience holds in the 30% that still needs a person. You also get a free plan with what to learn next. We never keep your résumé.

Check my résuméHiring? Check a job posting

Questions people ask

Will AI replace penetration testers?

Much of the work, but not all of it. AI could take on about 70% of the working time in a typical penetration tester job today. The other 30% still needs a person. That is a split of the work, not a forecast of jobs lost.

Which parts of the job can AI do?

The biggest ones AI can do or help with: find security weaknesses with pen tests, track new hacking trends, gather intelligence on vulnerabilities, identify new threat actor techniques, document penetration test findings, learn new testing tools and methods.

Which parts still need a person?

The biggest ones: discuss security fixes with IT teams, attempt to break into systems, find security weaknesses with pen tests, evaluate vulnerability assessments, gather intelligence on vulnerabilities, develop penetration testing processes.

How is this measured?

The U.S. Department of Labor lists 22 responsibilities for this job (O*NET 31.0), and the split covers the 21 people in it do today. Each is scored on 4 questions: can AI do it, does it get it right, must a person sign for it, and do people need to deal with a real person. The split is weighted by how much of the job each responsibility takes up. The evidence range for the share AI could take on is 48 to 70%. One end comes from how well AI did each responsibility in real use, or a second rating where that isn't measured. The other is our figure, which also follows research across the industry. Scores version 0.7.17, updated October 28, 2026.

Responsibilities from O*NET 31.0 (U.S. Department of Labor). Pay from the Bureau of Labor Statistics, May 2025. Scores are calibrated to published research and updated every month. How it works.

Related jobs

All 231 jobs, ranked · Jobs AI can't replace yet