Arnica Launches Agentic AI for Automated Penetration Testing

 Arnica, the governance and security platform for the Agentic Software Development Lifecycle (ASDLC), announced the launch of Arnica’s Agentic Pen Testing, a new capability that proves which vulnerabilities can actually be exploited in a live application and connects them directly to remediation.

Read more – Traefik Labs Expands Partner Ecosystem for AI Governance

AI coding assistants and agents are changing how quickly applications are built and modified, but penetration testing is often still a manual, time-intensive exercise performed at fixed intervals. Even continuous testing falls short if exploitable weaknesses are only discovered after software reaches production. Arnica’s Agentic Pen Testing automates exploit validation exactly where developers make changes, extending Arnica’s governance of AI-generated code beyond the moment code is written and into whether what ships can actually be attacked, replacing manual testing with agents that scale to the same pace as code production.

Rather than relying on isolated scanner findings, Arnica combines four layers of context: source code analysis, cloud infrastructure, live application behavior, and business-specific information. By enriching this view with context learned from customer environments, input from product teams, and feedback from developers, Arnica builds a continuously improving understanding of each organization’s unique security landscape. Its agents interact with running applications to verify whether suspected weaknesses can actually be exploited, then connect validated findings to developer remediation workflows. This combination of Arnica’s proprietary security intelligence and customer-specific data helps teams distinguish real, exploitable risk from potential vulnerabilities and prioritize the fixes that matter most.

Read more – Broward County Selects ServiceNow to Deploy AI Agents

“Penetration testing was built for a world where code shipped in slow iterations,” said Nir Valtman, Co-Founder and CEO of Arnica. “AI has changed that pace, and security validation can’t stay a periodic checkpoint. Security teams need to know both where a weakness might exist and whether it can be exploited in the environment that matters. The goal isn’t more alerts. It’s fewer, better-proven ones that get fixed automatically.”

Key capabilities include:

* Full-stack exploitability context. Combines AI SAST, software composition analysis, and infrastructure-as-code findings with cloud deployment context, live application testing, and relevant architecture, threat models, and developer feedback.

* Automated onboarding and discovery. Supports automated account creation and MFA handling, temporary email and SMS resources, discovery of endpoints, APIs, and application logic, and VPN access for authorized testing of internal applications.

* Development-aware testing. Runs comprehensive assessments or incremental tests informed by code changes and existing development workflows, integrating security validation into the tools and processes teams already use. This helps teams test at the right point in the development lifecycle, prioritize changed components, and avoid unnecessarily retesting unchanged code.

* Connected remediation and verification. Can create proposed fix pull requests, retest after code changes, alert teams when a critical vulnerability is proven exploitable, and bring in human reviewers when approval or judgment is required.

Read more –VIACHAIN and Star Solutions Formalize Alliance to Keep Containers Connected at Sea

* Task-specific AI orchestration. Uses a smart model router and specialized models to select the model, testing harness, and context suited to each task, with the goal of limiting unnecessary cost and false positives.

By linking discovery, exploit validation, remediation, and retesting into one loop, Agentic Pen Testing is built to help application security teams spend less time triaging theoretical findings and more time addressing demonstrated threats. It also supports the shift toward increasingly autonomous software development, where security has to keep pace with code changes without becoming a release bottleneck.