AI is starting to appear everywhere in penetration testing. Vendors are adding it to scanners, security teams are building internal tools around it, and testers are increasingly using LLMs during engagements. Some of it is genuinely useful. Some of it is little more than a new interface on top of automation we've had for years. The more interesting question is whether AI can actually replace manual penetration testing. From what I've seen, the answer is no, it can make an assessment faster, but

At the end of last year, we mapped out the cyber risks shaping 2026. Since then, we've watched them play out in real time, Jaguar Land Rover, Transport for London, the Department for Education, Marks & Spencer, Co-op, Harrods. Different companies, same five root causes. Here's the uncomfortable truth: the hackers aren't smarter, they're just faster, with better tools. AI writes their phishing emails now. Your suppliers are their favourite backdoor. And your team's new favourite AI chatbot...

Five years in prison, £1.9 billion in economic damage, £50 million spent on security improvements, and a breach happened anyway. 2026 hasn't been defined by new attacker tricks. It's been defined by the consequences of 2025's biggest breaches finally landing: prison sentences, nine-figure recovery bills, and government reports turning last year's headlines into this year's case studies. Meanwhile, a fresh wave of incidents shows the same weaknesses, legacy systems, shared IT infrastructure,...