Pick the AI penetration testing tool by the attack surface you need covered: Horizon3.ai NodeZero for internal networks and Active Directory, Aikido or XBOW for web apps and APIs. Keep one human pentest a year, because PCI still defines a penetration test as a manual process and no AI tool in this group has an independent test showing it finds business logic flaws.
The two kinds of product share a label and almost nothing else. NodeZero and Pentera attack a network the way an intruder who already has a foothold would: credentials, misconfigurations, a path to domain admin. XBOW, Aikido and RunSybil attack a running web application through its login, its APIs and its authorization checks. If you buy the wrong kind for your surface, you will get a clean report on a surface you weren't worried about.
| Tool | Best target | Pricing (checked November 13, 2026) | Independent evidence | Do not buy it if |
|---|---|---|---|---|
| Horizon3.ai NodeZero | Internal network, AD, external perimeter, AWS/Azure | Published: $15 per asset per test (Flex) or $50 to $85 per asset per year, unlimited tests | None independent; GOAD result is the vendor's | Your risk is in custom web apps |
| XBOW | Web apps and APIs, large portfolios | Quote only; $4,000 per test (Plus) when Doyensec bought it in spring 2026 | Doyensec head-to-head: 31 true positives across two apps | You need multi-user authorization testing on a single app this quarter |
| Aikido (Attack) | Web apps and APIs, single SaaS product | $4,000 per assessment, one app and its primary APIs | Doyensec head-to-head: 49 true positives across two apps (Aikido sponsored it) | You need internal network or AD coverage |
| Pentera | Internal network, external, cloud identity | Quote only | None found | You can't commit to an annual platform contract |
| RunSybil | Web apps, APIs, cloud infrastructure | Quote only | None found | You need a compliance report from a tool with a public track record |
The loser for most buyers right now is RunSybil. It may turn out to be good, but it publishes no price, no scope or safety controls on its site, and no third-party test results, so you would be buying on its funding round and customer logos. Revisit it when someone outside the company has tested it.
Which AI Pentesting Tool Fits Which Attack Surface?
An AI penetration testing tool is software that discovers, exploits and reports vulnerabilities in your systems with an agent choosing the next step, instead of a person running each tool by hand. The ones below split cleanly by where they attack.
Internal networks and Active Directory: NodeZero, then Pentera. NodeZero's own product page lists internal, external, Kubernetes and cloud pentesting plus an AD password audit, and says internal tests run from a Docker host or OVA you set up, with no endpoint agents. Its showcase result is the Game of Active Directory lab: Horizon3 says NodeZero solved GOAD in 14 minutes, against twelve to sixteen hours for a human expert. That is a vendor claim on a public lab, and nobody has published a replication. What tips the choice is that Horizon3 publishes its prices, so you can model the cost before talking to sales. Pentera covers the same ground with Core (internal), Surface (external) and Cloud modules, AD password testing, and now an AI web app offering, and says its attacks are designed to run safely in production. It publishes no price. If your security team already runs Pentera, nothing here argues for switching. If you are buying fresh, start with the vendor whose price you can check.
Web apps and APIs: Aikido for one product, XBOW for a portfolio. XBOW's homepage scopes the product to web applications and APIs and lists the usual classes: auth, SQL injection, IDOR, SSRF, RCE, XSS. Its credibility comes from bug bounties: XBOW reached the top of HackerOne's US leaderboard in 2025 with no human driving the attacks, by its own account. Its pricing page now says only that pricing is usage based and "scoped to your environment," and it sells through the AWS, Google, Oracle and Microsoft marketplaces, which matters if you are burning down a cloud commit across hundreds of apps. Aikido's pricing page lists a $4,000 assessment covering one application and its primary APIs, plus scope-priced tests from $50 to $30,000+. For a SaaS company that needs one app tested and a report this month, Aikido's self-serve flow is the faster path.
RunSybil describes an offensive security platform that tests web apps, APIs and cloud infrastructure, including IAM misconfigurations and CI/CD secret exposure, and sells a SOC 2 penetration testing service. It raised $40 million led by Khosla Ventures in March 2026; Fortune reported that its founders came from OpenAI's security team and Meta's offensive red teams, and that Cursor, Notion and Baseten are customers. The site doesn't say whether internal networks are in scope.
What Doyensec's Head-to-Head of XBOW and Aikido Found
The only independent comparison of the commercial tools in this group is Doyensec's May 2026 study, and it has one disclosure you need up front: the full report states that Aikido sponsored it. Doyensec says Aikido had no part in collecting or presenting the results, but did have input into the study's constraints. The two target apps (Fider 0.33.0 and Photoview 2.4.0) were picked at random from 442 self-hosted open-source apps, and both platforms were bought at the same tier: $4,000 per test, Aikido's Standard against XBOW's Plus.
Doyensec manually validated every finding:
| Aikido true positives | XBOW true positives | Found by both | |
|---|---|---|---|
| Fider | 17 of 19 reported | 24 of 25 reported | 3 |
| Photoview | 32 of 32 reported | 7 of 7 reported | 4 |
| Total | 49 | 31 | 7 |
Three things in that table matter more than who won. First, false positives were low for both: 2 for Aikido and 1 for XBOW. Second, the overlap was tiny. Two tools at the same price found mostly different bugs in the same app, which tells you any single AI scan is a sample and gives no proof of coverage. Third, the tools leaned different ways: on Fider, XBOW found more injection and cross-site scripting bugs, while Aikido found more design flaws.
Severity was the weak spot for both. Doyensec says it ended up "changing (mostly lowering) severities more than disputing the validity of reported findings." It disagreed with Aikido's severity on 24% of Fider findings and 34% of Photoview findings, and with XBOW's on 29% of Fider findings. If your remediation SLAs key off the tool's severity, expect your engineers to fix some mediums that a human would have filed as informational.
The operational gap was larger than the findings gap. Aikido took under 20 minutes to configure and delivered reports the day of the scan. XBOW required sales approval and a DocuSign order form, did not support social login or testing as multiple users at the time, and the Fider run took from April 10 to April 16 with the report arriving April 21. Neither tool replaced the human: Doyensec spent about 25 hours of researcher time validating the two platforms' findings across the two apps.
What AI Penetration Testing Costs Against a Human Engagement
Price comparisons in this category break because vendors meter different units: per test, per app, per asset per year. Here is one workload priced each way: a company with 3 customer-facing web apps with APIs and 1,000 internal assets (servers, workstations, cloud resources), tested quarterly. Prices are from each vendor's live page on November 13, 2026, except where marked.
| Option | Unit | Cost for this workload |
|---|---|---|
| NodeZero Flex | $15 per asset, per test | $15,000 per network test; $60,000 for four |
| NodeZero Core | $50 per asset, per year, unlimited tests | $50,000 a year |
| NodeZero WebApp Flex | $10,000 per app, per test | $30,000 per round of 3 apps |
| Aikido Standard | $4,000 per app assessment | $12,000 per round of 3 apps |
| XBOW | Quote only | $12,000 per round at the $4,000 Plus price Doyensec paid (no longer listed) |
| Pentera, RunSybil | Quote only | Ask for a quote on this exact scope |
| Human consultancy | Per engagement | $8,000 to $30,000 per web app or internal test, per BD Emerson's July 2026 guide (a firm that sells pentests) |
The NodeZero numbers come straight from Horizon3's pricing page, which defines an asset as any server, workstation, network device, cloud resource or internet-facing service, and counts a machine with several identifiers once. Core breaks even with Flex at about 3.3 tests a year, so anyone testing quarterly should buy Core. Pro ($65) and Elite ($85) add features at the same per-asset annual unit, and premium support costs another 10% to 20% of the subscription.
The comparison with a human engagement comes down to frequency. One human test of three apps and the internal network runs $32,000 to $120,000 at the BD Emerson range, once a year. For about the same money, NodeZero Core plus two rounds of Aikido web tests gets you unlimited internal testing and twice-yearly app coverage. Add one human engagement scoped to what the tools miss and you still land inside the human-only range.
Does an AI Pentest Satisfy PCI DSS, SOC 2 and Customer Questionnaires?
For PCI, an AI-only pentest is a risk you carry into the assessment. The PCI Security Standards Council's penetration testing guidance describes a penetration test as "a manual process that may include the use of vulnerability scanning or other automated tools," and requires both application-layer and network-layer testing in scope. Requirement 11.4.2 asks the assessor to confirm the test was performed by a qualified internal resource or qualified external third party with organizational independence. That guidance dates from 2015 (version 1.1 followed in 2017) and was written before these tools existed, so whether an autonomous test counts is your QSA's call. Ask them in writing before you cancel the human engagement.
SOC 2 is looser. No Trust Services Criterion requires a penetration test; it appears as an example under CC4.1's points of focus, as Drata explains. Your auditor will usually accept whatever your control description promises. Aikido markets its Standard test as producing a report for SOC 2 and ISO 27001, and XBOW lists SOC 2 and PCI DSS on its homepage without saying what that listing covers.
Customer questionnaires are the check to run first. Enterprise security reviewers often ask who performed the test and what their credentials are. If your biggest customers' questionnaires name a tester qualification such as OSCP or CREST, an AI report won't answer that question. Keep the human test for the report you hand to customers, and use the AI tools to keep the gap between those reports short.
Production Safety: Who Pays When the Agent Breaks Something?
Every vendor here says its testing is production safe. The Doyensec report shows what that means on a real app. XBOW's agent changed Fider's default authentication mechanism, which locked out further logins; it deleted its own test account; the target went unresponsive twice until the instance was upgraded and more than 4,000 database entries were deleted; and the app sent over 4,800 emails through the team's Mailgun account. Doyensec notes it left rate limits at the defaults and that tuning might have avoided the outages. Aikido's own setup flow makes you confirm that the test "may run destructive tests" and that the target "is not a production environment."
Horizon3's WebApp safety documentation is the most candid of the group: "production-safe does not mean that testing makes no changes." Depending on the rules you pick, a test may create accounts, submit posts and leave stored payloads, which NodeZero logs for cleanup.
Liability is the part your contract has to settle. XBOW's own guidance on legal boundaries says indemnification language "should address out-of-scope activity, third-party impact, data exposure," and warns that broad scope language and incomplete records make liability harder to assign. Read where the vendor's standard terms cap its liability, then negotiate. Before any agent touches production, get four things in writing: the exact in-scope hosts and URLs, the rate limit and testing window, a named person who can stop the run, and the vendor's indemnity for actions outside scope. Run web app agents against a staging copy with production-like data first. Network tools like NodeZero can run in production, but schedule them inside a change window.
What AI Pentest Tools Still Miss
Business logic is the gap. A business logic flaw is a bug in what the application allows rather than how it is coded: a discount applied twice, a refund issued to a different account, an approval step a user can skip. The tool has to know the intended rule to spot the violation, and an agent that learns your app by crawling it and reading its code has no source for rules that live in a product spec.
Doyensec's study was not designed to measure misses, and it did not count true negatives. Its own constraint is telling, though: with only one credential set, XBOW couldn't test one user's access to another user's data, which is where many authorization bugs live. Aikido's flow asks for at least one user per role and two tenants for exactly this reason. If your product is multi-tenant, check that any tool you buy supports multi-user testing before you sign.
The annual human pentest is still worth paying for, with a narrower scope. Point the human engagement to multi-step abuse of your payment, approval and tenant boundaries, plus whatever your QSA or largest customer requires. Let the AI tools carry injection, misconfiguration and known-pattern coverage between engagements.
How to Decide: The Criteria That Predict Regret
The buyers who regret these purchases usually bought for the wrong attack surface or assumed the report would satisfy an auditor. Four questions catch both:
- Where would a breach of your company actually start? Phished credentials and a flat internal network point to NodeZero or Pentera. A customer-facing SaaS app points to Aikido, XBOW or RunSybil.
- Will your QSA or biggest customer accept the report? Ask before you buy, in writing.
- Can it test as two users in two tenants? If not, it can't check whether one customer can read another's data.
- Who validates the findings? Budget a senior engineer's time. Doyensec needed about 25 hours for two apps.
What changes the answer: a portfolio of hundreds of apps pushes you toward XBOW's usage-based, marketplace-billed model. A single regulated cardholder data environment pushes you back toward a human-led test with AI tools as support.
This Week:
- Send your QSA and your two largest customers' security reviewers one question: will an AI-generated pentest report satisfy your requirement?
- Count your assets the way Horizon3 does (one machine, all its identifiers) and price NodeZero Flex against Core.
This Month:
- Run one $4,000 Aikido Standard test on a staging copy of your main app, and ask XBOW for a quote on the same scope.
- Write the four contract terms from the safety section into your security testing addendum.
Before Your Next Annual Pentest:
- Rescope the human engagement to business logic, tenant isolation and anything your QSA requires, and cut the hours that duplicate what the tools now cover.
The Bottom Line
Pentera and Horizon3 have sold automated network attack tools for years, and agents that work through a web app's login and APIs are the newer half of this market. The Doyensec numbers show both web tools finding real bugs with few false positives, missing each other's findings, and getting severity wrong about a third of the time. Buy NodeZero if your exposure is the internal network, test your app with Aikido or XBOW on staging, and send the QSA question before you cancel anything.
Continue Reading
- Garak vs PyRIT vs Promptfoo: Pick Promptfoo for Agent CI
- Choose Prophet or Dropzone for Mixed-Stack AI SOC Triage
- CrowdStrike Agrees to Buy Dreadnode for Automated AI Testing
- GPT-6 Cyber Tests Found No Wins on Fully Hardened Targets
- Anthropic Adds Red Team Access to Cyber Verification Program
- Audit Microsoft 365 App Grants After Storm-0940's ConnectWise Attack