Autonomous pentesting is security testing in which software sequences reconnaissance, probing, validation, and reporting with minimal human input. An operator still sets scope and rules, but the system can choose the next action based on previous results, often by combining many tools into a feedback loop.
This matters because it speeds up authorized assessments and can reveal weaknesses that a static scan might miss. In real attacks, the same idea can be used to adapt probes, fingerprint web defenses such as WAFs, and move from broad discovery to targeted checks. Defenders should expect more machine-driven testing, then harden systems by reducing fingerprintable responses, applying rate limits, patching exposed services, and separating legitimate automation from suspicious traffic.