Automation is speeding up offensive testing, yet a suspicious pattern only becomes a useful vulnerability when a person can prove it behaves like one.