Arnica Launches Agentic Penetration Testing to Detect and Verify Real Security Flaws and Fix Them Automatically

New tool tests live applications the way an attacker would, separates real, exploitable risk from theoretical findings, and routes fixes straight to developers

ATLANTA , GA, UNITED STATES, November 5, 2026 /EINPresswire.com/ — Arnica, the governance and security platform for the Agentic Software Development Lifecycle (ASDLC), today announced the launch of Arnica’s Agentic Pen Testing, a new capability that proves which vulnerabilities can actually be exploited in a live application and connects them directly to remediation.

AI coding assistants and agents are changing how quickly applications are built and modified, but penetration testing is often still a manual, time-intensive exercise performed at fixed intervals. Even continuous testing falls short if exploitable weaknesses are only discovered after software reaches production. Arnica’s Agentic Pen Testing automates exploit validation exactly where developers make changes, extending Arnica’s governance of AI-generated code beyond the moment code is written and into whether what ships can actually be attacked, replacing manual testing with agents that scale to the same pace as code production.

Rather than relying on isolated scanner findings, Arnica combines four layers of context: source code analysis, cloud infrastructure, live application behavior, and business-specific information. By enriching this view with context learned from customer environments, input from product teams, and feedback from developers, Arnica builds a continuously improving understanding of each organization’s unique security landscape. Its agents interact with running applications to verify whether suspected weaknesses can actually be exploited, then connect validated findings to developer remediation workflows. This combination of Arnica’s proprietary security intelligence and customer-specific data helps teams distinguish real, exploitable risk from potential vulnerabilities and prioritize the fixes that matter most.

“Penetration testing was built for a world where code shipped in slow iterations,” said Nir Valtman, Co-Founder and CEO of Arnica. “AI has changed that pace, and security validation can’t stay a periodic checkpoint. Security teams need to know both where a weakness might exist and whether it can be exploited in the environment that matters. The goal isn’t more alerts. It’s fewer, better-proven ones that get fixed automatically.”

Key capabilities include:

* Full-stack exploitability context. Combines AI SAST, software composition analysis, and infrastructure-as-code findings with cloud deployment context, live application testing, and relevant architecture, threat models, and developer feedback.

* Automated onboarding and discovery. Supports automated account creation and MFA handling, temporary email and SMS resources, discovery of endpoints, APIs, and application logic, and VPN access for authorized testing of internal applications.

* Development-aware testing. Runs comprehensive assessments or incremental tests informed by code changes and existing development workflows, integrating security validation into the tools and processes teams already use. This helps teams test at the right point in the development lifecycle, prioritize changed components, and avoid unnecessarily retesting unchanged code.

* Connected remediation and verification. Can create proposed fix pull requests, retest after code changes, alert teams when a critical vulnerability is proven exploitable, and bring in human reviewers when approval or judgment is required.

* Task-specific AI orchestration. Uses a smart model router and specialized models to select the model, testing harness, and context suited to each task, with the goal of limiting unnecessary cost and false positives.

By linking discovery, exploit validation, remediation, and retesting into one loop, Agentic Pen Testing is built to help application security teams spend less time triaging theoretical findings and more time addressing demonstrated threats. It also supports the shift toward increasingly autonomous software development, where security has to keep pace with code changes without becoming a release bottleneck.

Arnica’s Agentic Pen Testing begins a controlled rollout on November 5, 2026. Organizations interested in participating can contact Arnica at www.arnica.io/campaigns/agentic-pen-testing.

For more information about Agentic Pen Testing and Arnica’s suite of developer-native AppSec solutions, visit www.arnica.io.

###

About Arnica
Arnica, headquartered in Atlanta, Georgia, powers the most effective application security programs in the world. At Arnica, we envision and build toward a future in which software development is unimpeded by risk. We build solutions that secure the software development lifecycle, align to developers rather than disrupt them, remove barriers to security by simplifying risk mitigation, and are loved by both security and developers. For more information on Arnica, visit www.arnica.io

Nicolia Wiles
PRIME|PR
+1 833-279-8096
Visit us on social media:
LinkedIn
Facebook

Media gallery