Arnica launches agentic pen testing to prove exploitable flaws and push fixes to developers

Arnica on Nov. 5 launched Agentic Pen Testing, a new capability that tests live applications like an attacker, verifies which vulnerabilities are truly exploitable and routes fixes into developer workflows. The rollout aims to help security teams cut false positives and keep pace with AI-driven software development.

Why it matters: - Arnica’s new capability is designed to separate theoretical findings from real, exploitable vulnerabilities in live applications. - The tool is aimed at security teams that need faster validation as AI coding tools and agents accelerate software changes. - Arnica says the workflow can help teams spend less time triaging alerts and more time fixing demonstrated threats.

What happened: - Arnica announced Agentic Pen Testing on Nov. 5, 2026, from Atlanta. - The new capability tests live applications the way an attacker would and connects validated issues directly to remediation. - Arnica said the rollout begins as a controlled launch on Nov. 5, 2026. - Organizations interested in participating can contact Arnica at Arnica’s agentic pen testing page. - More information about the product is available at Arnica’s website.

The details: - Arnica combines four layers of context: source code analysis, cloud infrastructure, live application behavior and business-specific information. - The platform enriches that view with customer environment data, input from product teams and feedback from developers. - Arnica’s agents interact with running applications to verify whether suspected weaknesses can actually be exploited. - Validated findings are tied into developer remediation workflows. - The company says the system helps distinguish real risk from potential vulnerabilities and prioritize the fixes that matter most. - Nir Valtman, Arnica co-founder and CEO, said security validation cannot remain a periodic checkpoint as AI changes development speed. - Valtman said the goal is fewer, better-proven alerts that get fixed automatically. - Key capability areas include full-stack exploitability context, automated onboarding and discovery, development-aware testing, connected remediation and verification, and task-specific AI orchestration. - Full-stack exploitability context combines AI SAST, software composition analysis, infrastructure-as-code findings, cloud deployment context, live application testing and architecture, threat model and developer feedback. - Automated onboarding and discovery supports account creation, MFA handling, temporary email and SMS resources, endpoint and API discovery, application logic discovery and VPN access for authorized internal testing. - Development-aware testing can run comprehensive assessments or incremental tests based on code changes and existing workflows. - Development-aware testing is meant to help teams avoid retesting unchanged code. - Connected remediation and verification can create proposed fix pull requests, retest after code changes, alert teams when a critical vulnerability is proven exploitable and bring in human reviewers when needed. - Task-specific AI orchestration uses a smart model router and specialized models to choose the model, testing harness and context for each task. - Arnica says that approach is intended to limit unnecessary cost and false positives.

Between the lines: - Arnica is positioning Agentic Pen Testing as an extension of its governance for AI-generated code beyond code creation and into exploit validation. - The product reflects a broader shift toward software development that changes faster than traditional security review cycles. - The release suggests security tools are moving from static findings toward verified, workflow-linked remediation.

What's next: - Arnica said organizations can begin participating in the controlled rollout immediately. - The company is pitching the launch as part of its broader developer-native AppSec portfolio. - Arnica is likely to use customer feedback from the rollout to refine the system’s context and validation loop.

The bottom line: - Arnica wants to make penetration testing faster, more automated and tied to real exploitability, not just scanner output.