AI security testing gaps

A 2026 Synack survey of security leaders found that 95 % of firms discovered serious or critical AI‑related vulnerabilities outside regular penetration‑testing windows, exposing coverage, trust, and maturity gaps in their security programmes. Only 15 % described their testing as continuous, and 79 % said they would not act on AI‑generated results without human validation. At the Munich Cyber Tactics, Techniques and Procedures (MCTTP) conference, a five‑zone model was introduced to shift analysis from individual components to hidden attack paths linking AI agents, retrieval‑augmented generation systems and multi‑component platforms.

Later that month, a series of AI‑driven software failures caused widespread service outages in Japan, Australia, the United States, New Zealand and elsewhere, affecting payment networks, airline operations and cloud services. Despite the surge in AI‑identified flaws, a VulnCheck study of over a thousand such findings reported that only around 1.3 % were actually exploited, a rate comparable to traditional vulnerabilities. Together, the survey and outage reports illustrate persistent gaps in AI security testing and the limited translation of AI‑discovered flaws into real‑world attacks.