Global Cyber Conference 2026: What Security Leaders Actually Think About Agentic Hacking

‍

At the Global Cyber Conference 2026 at the Dolder Grand in Zurich, SignalFisher hosted a roundtable on agentic hacking. The room was full with more than 40 people, including CISOs and security leaders from across Europe. Though naturally not everyone in the room spoke, what follows reflects the voices who did. As Field CISO at SignalFisher, I moderated the session, alongside our co-founders Sandro Nafzger (CEO) and Florian Badertscher (COO and Product Lead). The rule for the hour was simple:  Off the record, Chatham House Rule. What follows is what the room actually said, with no names attached to any of it beyond the three of us hosting.

We opened with a few statistics from the field, gathered at Black Hat USA in Las Vegas and our own research, plus a brief framing of what “agentic hacking” means right now. We then handed the floor over, and the room took it and ran. What was supposed to be a moderated conversation turned into a discussion and debate between participants, which is exactly what we'd hoped for.

Here's what came out of it.

Shipping too fast, in a world that never stops shipping

The first thing the room agreed on, almost immediately, is that this isn't really a new problem. It's an old problem that's finally caught up with everyone. Agile-sprint code shipped faster than testing could keep up from years ago. Nobody fixed this process; everyone just got used to it. What's changed is that attackers are now using AI to move at that same shipping speed, and the gap between “shipped” and “tested” is no longer survivable.

No one in the room defended the current pace. Several people pointed out, in different words, that the volume of flaws hasn't gone up because code got worse. It's gone up because there's simply more code, shipped faster than ever, with security testing that never scaled to match.

Point-in-time testing is already dead

This one didn't need much convincing. The idea that a pentest twice a year, or even quarterly, tells you anything meaningful about your risk on the days in between got no defenders in the room. The consensus was blunt:  If your test cadence has gaps, those gaps are now the attack surface, not a footnote to it.

The word that came up over and over wasn't “faster.” It was continuous. Not more frequent snapshots, but no snapshots at all. Testing as a running condition of the environment, not an event you schedule and then forget about until the next one.

There was a brief detour into whether the smarter bet is testing further in advance or simply getting faster at detecting issues once they surface. It didn't run long, and the room didn't linger on it. The pull toward continuous testing was strong enough that the distinction didn't end up mattering much for where the conversation went next.

Context and risk beat coverage

The second point followed naturally from the first:  Once testing is a constant, the volume of findings stop being the bottleneck and prioritization becomes the actual battlefield. Several people were candid that their teams are already drowning in output from existing tools. More scanning doesn't help if no one can tell which alert actually matters.

The room was in consensus that risk-based, context-aware triage isn't a nice-to-have layered on top of testing. It must be the design principle underneath it. A vulnerability without business context is a data point, not a decision.

AI's job isn't to run the test. It's to fix the processes around it.

This was probably the sharpest turn in the conversation, and it's worth stating plainly because it runs counter to much of the current AI-security narrative. No one in the room was excited about AI as a faster test executor. What they wanted was AI applied to the mess around testing like the broken, manual, cross-team processing of receiving a finding from discovery to actually fixing it.

Routing. Ownership. Getting DevOps, SecOps, and application teams to agree on who owns a fix, without three tools and two tickets getting lost in translation. The room's appetite was for AI support in closing the loop faster on the parts of the process that are broken today.

Accountability must move to the business

Related, and just as bluntly, several people said, that security teams have been holding accountability for remediation they don't actually control. The finding gets surfaced by security. The fix gets made, or doesn't, by an application owner in the business who has other priorities and no real incentive to move fast.

The room's read was that this has to flip. Application owners need to own the risk they're creating, not just receive a ticket. Security's job is to make the risk visible and impossible to ignore, not to chase every business unit for a fix it doesn't feel is its problem.

Overwhelmed, and not shy about saying so

If there was a mood in the room beneath all six points, it was this one - Teams are overwhelmed, and everyone was refreshingly honest about it. Nobody postured about having it under control. The volume of findings most teams face today has outgrown the human capacity to triage it, and that gap was named openly, more than once, without anyone pretending otherwise.

That honesty was, in a strange way, the best part of the hour. A room full of senior security leaders admitting that the current model doesn't scale is a more useful signal than any vendor deck could ever produce.

Where that leaves us

None of this surprises anyone in the space. But hearing it converge, unprompted, from leaders in the room who don't work together on a day-to-day basis, and mostly not knowing each other, is different from reading it in a report. The room didn't need convincing that testing has to become continuous, that context needs to drive prioritization, or that AI's best use right now is fixing broken processes rather than finding more things wrong. They'd already arrived there on their own.

What came through clearly, even if nobody in the room used these exact words, is a shared picture of where security testing is heading. Not another tool, and not a pile of disconnected ones either. A genuinely holistic view of testing, where pentesting, vulnerability scanning, bug bounty engagements, and red teaming stop competing for budget and start working as the various execution methods inside one comprehensive system. What ties them together is a single AI-driven platform that runs the whole process end to end, from scoping the work, through execution, to routing the finding to the right owner and confirming the fix happened. This entire process should work seamlessly, without the handoffs, where everything currently falls apart.

Thank you to everyone present who made this roundtable a candid and valuable conversation.  If you were in the room, thank you for making it a real open conversation. If you weren't, we'll be back next time. Until then, reach out and share your perspective.

‍

ABOUT THE AUTHOR

Christophe Németh

Field CISO SignalFisher

Trusted advisor to CISOs on intelligent outcome-based security testing

‍