What Should You Probe When Hiring an Agentic Penetration Tester?

What Does an Attack Agent Leave Behind for a Human Pen Tester?

It's Thursday and the agent has been running against the client's staging estate since Monday. The queue holds 41 candidate findings. Nine are duplicates of the same misconfiguration, four cite a CVE that does not apply to the installed build, and one is a genuine chained path from an exposed metadata endpoint to a service account. The person you are hiring is the one who finds that one by Friday.

That triage is the job now. Penetration Testers were already growing fast enough to sit on O*NET's short New and Emerging Bright Outlook list, one of four occupations on it ¹, and the tooling arrived on top of that demand rather than in place of it. Agents cover breadth well: port sweeps, credential spraying, permutation of a payload until something returns a different error. What they cover badly is scope. An agent told to test a subdomain will test the subdomain, including the parts a third party actually owns, and the result is a legal problem rather than a report.

So read the role as three shifts. Reconnaissance and exploit iteration move to the machine. Scoping, rules of engagement, and the call that a finding is real move up in weight. And a task appears that barely existed five years ago: emulating an adversary who is themselves running agents, at a tempo a two-person crew could not previously sustain. One vendor blog puts the share of 2026 cybersecurity job descriptions asking for AI or automation skills at 64 percent ³ and publishes no method behind it, so read that as a mood reading rather than a measurement. Postings are weak evidence in any case. The skill hiding inside the requirement is what the interview has to reach, and no market number will tell you whether the candidate in front of you has it.

Probe Verification, Not the Tool List, in the Pentester Interview

Tool names are the cheapest thing on a resume and the easiest to perform. Verification is not performable, because it leaves artifacts: a proof-of-concept the candidate wrote by hand, a finding they downgraded and can explain, a client report where the severity moved after they reproduced it. Ask for those artifacts by name and the conversation stops being about which platform they hold a login for.

The exercise that separates candidates fastest is a transcript read. Hand over forty minutes of raw agent output from a lab environment containing one reproducible finding, one duplicate, and one confident claim resting on a version string the agent misread. Say nothing about which is which. Watch four things: whether they check the version themselves before arguing about the CVE, whether they ask what the scope document said, whether they can state what the agent never tried, and how they describe the run when it was wrong. A candidate who says the agent hallucinated and moves on has told you less than one who says the agent read the banner literally and never confirmed it against the package manifest.

The best of these people got good by turning the tooling on themselves. They keep the habit of asking a model to argue the opposite finding, of rerunning the same prompt with the scope narrowed to see whether the conclusion survives, of writing the exploitation step manually first and then asking the assistant what they missed. Ask when an assistant was last confidently wrong in a way that would have shipped, and what they changed about their workflow afterward. Vague answers there are the strongest single negative signal in the loop. The same habit shows up in a good AI red team engineer, and candidates cross between the two roles often.

Which Backgrounds Produce a Pentester Who Can Supervise Agents?

Three feeders show up repeatedly. Consultancy pentesters with four or more years of client reports, who already own scoping and severity judgment. Platform and site reliability engineers who moved sideways into offense and understand cloud identity better than most testers do. And CTF players who never held a security title and read protocol behavior faster than anyone else you will interview.

Two unexpected feeders are worth opening a requisition for. Machine learning infrastructure engineers bring something scarce: they know how a model actually fails, so they treat an agent's confident output as a distribution rather than an oracle, and they can test the client's own AI systems as part of scope. QA automation engineers bring the other scarce thing, which is the reflex to reproduce a defect from a clean state before reporting it. Both need mentoring on rules of engagement and disclosure, and both learn that faster than a certified tester learns to distrust a machine.

Require less than the template does. An OSCP proves hands-on exploitation and it proves nothing about supervising a long-running agent across a hundred hosts. A degree predicts almost nothing here. What is worth insisting on is written work you can read: a disclosure writeup, a tool, a blog post reasoning through a failed attempt. If a candidate cannot produce one artifact anyone outside their employer has seen, the interview has to carry the whole load, and it will carry it badly.

Where Do Agentic Pentesters Come From, and What Closes Them?

You will not find them on a job board first. Offensive security hiring runs on proof and reputation: conference villages, published research, bug bounty profiles under a handle, and the Discord and Slack rooms attached to CTF teams. Sourcing means reading someone's work and then writing to them about the specific thing they published, which costs a hiring manager an hour of their own time and cannot be delegated to a sequence.

The venues are concrete. DEF CON's AI Village and Red Team Village, Black Hat Arsenal, and regional BSides events put practitioners in front of you cheaply. HackerOne and Bugcrowd profiles show sustained work rather than a single lucky bug. Hack The Box and TryHackMe surface people with no security title yet. On the employer side, the consultancies are the training grounds: NCC Group, Bishop Fox, Trail of Bits and Mandiant produce testers who have written reports under client pressure, and their four-year alumni are the classic in-house hire. Adjacent titles that convert well are threat emulation, security engineering with an offensive remit, and vulnerability research.

Closing them turns on autonomy and publication. These candidates care about who holds scope authority, whether research time is real or theoretical, whether they may publish under their own name after disclosure, and whether they get budget for their own tooling instead of a single vendor platform. What kills the offer, in rough order: an NDA that forbids publication outright, a job that turns out to be a report factory with a quota, defensive on-call bolted onto an offensive role, and a legal function so slow that authorization arrives after the engagement window closes. Fix the last one before you make the offer, not after.

What Does an AI-Augmented Penetration Tester Cost, and Where Does the Work Sit?

No published salary series carries the agentic title yet, so price it off two anchors that are both proxies. O*NET reports a 2025 median of $116,580 for Computer Occupations, All Other, the broader group penetration testers are coded into ⁴. One security training vendor's 2026 roles list projects roughly $160,000 to $225,000 for an adversarial machine learning specialist ², a projection for a neighboring title rather than a survey of this one.

Use that pair as a floor and a ceiling rather than as a band, and note that no aggregator publishes the agentic title on its own as of mid-2026, so any single point estimate for it deserves suspicion. Structure matters as much as the base. Consultancy pay sits lower than in-house and buys variety and client volume; in-house pay sits higher and buys depth in one estate. Bug bounty earnings are a candidate's outside income, and a policy that forbids them costs more than it saves. Clearance-gated federal work carries its own premium and its own year-long start date.

Remote is the default for the work itself, with real exceptions. Physical intrusion tests, operational technology and industrial control assessments, air-gapped estates, and cleared programs all require presence, and agents do not change that. What agents do change is where the run lives: a long, autonomous engagement often needs a node inside the client's network, which pulls data residency, logging, and kill-switch authority into the contract. Ask candidates how they have handled a run they could not watch in real time.

One scoping note. If the target systems make automated decisions about people, the engagement sits next to obligations that an EU AI Act compliance officer owns, and the rules differ by jurisdiction and keep moving. Put the boundary in writing before an agent touches anything, and check with counsel rather than with the tester.

See how it works >