Dominic Jainy is a distinguished IT professional whose work at the intersection of artificial intelligence and cybersecurity has redefined how modern organizations approach risk. In an era where code is generated and shipped at a pace that often outstrips human oversight, his insights into automated red teaming and machine-driven discovery are more critical than ever. In this conversation, we explore the shifting landscape of DevSecOps, the limitations of traditional vulnerability scanning, and how the integration of persistent AI pentesting is bridging the gap between rapid development and robust security.
The discovery of CVE-2026-1731 in BeyondTrust products earlier this year highlighted how rapidly threats can emerge and be exploited. How is AI-assisted analysis changing the timeline between vulnerability discovery and weaponization?
It is a high-stakes race where the starting gun is fired the moment a single line of code is pushed to production. When researchers used AI to uncover that unauthenticated command injection flaw with a staggering 9.9 CVSS score, the industry felt a collective shiver because attackers were already knocking on doors within mere days of the disclosure. We are no longer just looking for bugs; we are fighting against automated adversaries that can scan the entire internet for a specific signature in a matter of hours. AI pentesting tools allow us to fight fire with fire by constantly probing our own defenses, ensuring that a critical flaw does not sit dormant for six months until the next scheduled manual audit. This shift from periodic checkups to persistent vigilance means we can finally close that dangerous window where a zero-day lives in the wild without a patch.
Vulnerability scanners have long been criticized for drowning developers in false positives and non-exploitable noise. In what ways does AI pentesting go beyond these static lists to provide actionable intelligence for engineering teams?
Standard scanners are essentially digital smoke detectors that go off every time someone burns a piece of toast; they simply lack the nuance to tell if the building is actually on fire. An AI pentester does not just flag a potential Cross-Site Scripting vulnerability based on a reflected input and walk away; it behaves like a digital detective, actively attempting to execute a harmless payload to prove the threat. If the first injection attempt is blocked by an encoding filter or a specific security control, the AI learns from that rejection and tries a different bypass technique in real-time to see if it can reach the browser. This produces a successful, concrete proof of concept that a developer can actually see and reproduce, removing the frustrating “it works on my machine” or “this isn’t a real bug” debates. By providing validated attack paths rather than just a list of suspicious strings, we save hundreds of engineering hours that would otherwise be wasted on manual triage.
You have noted that some of the most catastrophic breaches stem from misconfigurations rather than documented software bugs. How does the recent trend of exposed Model Context Protocol servers illustrate the need for testing that looks beyond simple CVE matches?
The situation with MCP servers is a perfect example of why a clean CVE scan can be dangerously misleading. Last year, researchers found 1,862 of these servers exposed to the internet, and when they checked a sample of 119 by hand, they found that every single one listed internal tools without any authentication. Some of these servers were connected to sensitive CRM platforms and financial databases, which is a nightmare scenario for data integrity. A traditional scanner might ignore these because the software itself is up to date, but AI pentesting asks the much more important question: “What can someone without authorization actually do with this access?” It can simulate the lateral movement required to see if an open server is just a public documentation search or a gateway that allows an attacker to modify financial records, providing a risk assessment based on actual impact rather than a database entry.
The traditional model of pentesting is often seen as a bottleneck that occurs right before a major release. How can organizations effectively weave AI-driven security into their existing delivery loops without slowing down the development cycle?
We have to stop treating security as a final exam and start treating it as a continuous feedback loop that lives within the software delivery lifecycle. In the old model, you would hand off a report, the developers would fix half of it, and then you would wait weeks for a retest, by which time the code had already changed three times. AI pentesting allows for immediate re-validation; as soon as a developer pushes a fix, the agent can hammer that specific endpoint to ensure the weakness is truly closed. This creates a psychological shift where findings arrive while the developer still has the context of the code fresh in their mind, rather than a month later when they have moved on to new features. It turns security into a proactive partner that monitors the deployed environment as a cohesive whole, checking what gets through the initial “shift-left” filters.
The ARTEMIS study showed an AI agent outperforming most professional pentesters on a massive network, yet it still missed a critical flaw that the humans caught. What does this tell us about the future division of labor between human expertise and automated agents?
The ARTEMIS results from December 2025 are a landmark because they prove that while machines are masters of volume, humans are still the masters of intuition. The agent placed second against ten professionals on a network of 8,000 hosts because it could enumerate assets and probe thousands of endpoints with a speed no human can match. However, the fact that it produced more false positives and missed a critical flaw that most humans found shows that AI still struggles with the “creative chaining” required for complex, multi-step attacks. Our human pentesters are moving away from the repetitive grunt work of asset discovery and are now focusing on high-level strategy and judgment calls. The practical model is using AI for speed and massive coverage, while the humans act as the ultimate arbiters of accountability, focusing their energy on the complex vulnerabilities that require true cognitive leaps.
What is your forecast for the state of DevSecOps and AI-driven security over the next two years?
By the end of 2028, I expect we will see the total disappearance of the “annual pentest” for high-growth organizations, replaced entirely by a “Continuous Security Posture.” Security testing will no longer be a separate event but a background process that runs every time a configuration is changed or a new server is spun up. We will likely see a massive consolidation where static and dynamic testing merge into a single, AI-orchestrated platform that understands the intent of the code as much as the syntax. The most successful teams will be those that use these autonomous agents to handle the high-volume work, allowing their human experts to evolve into elite threat hunters who spend their time anticipating the next generation of synthetic attacks rather than checking for basic misconfigurations.