--- title: Aikido launches external network pentesting | daily.dev description: Aikido now pentests a company's external network using AI agents. Given just a root domain, the agents map internet-facing systems like servers, VPN gateways... canonical: https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Aikido launches external network pentesting | daily.dev og:description: Aikido now pentests a company's external network using AI agents. Given just a root domain, the agents map internet-facing systems like servers, VPN gateways... og:url: https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu og:image: https://api.daily.dev/og/posts/1gQ6SOlvu.png og:image:alt: Aikido launches external network pentesting og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Aikido launches external network pentesting **[Aikido Security](https://daily.dev/sources/aikido-security)** · 8 min read · 0 upvotes · 0 comments ## Summary Aikido now pentests a company's external network using AI agents. Given just a root domain, the agents map internet-facing systems like servers, VPN gateways and mail servers, then attack them the way a real attacker would. Only findings backed by reproduced, validated evidence make the report, and each comes with a fix suggestion plus a retest option available for up to 6 months. The service runs continuously, testing new hosts as they appear, and is priced yearly based on the size of the external network at the time of the first pentest. Aikido's 2026 State of AI in Pentesting report found 48% of 400 surveyed security and engineering leaders said pentest findings are already outdated by the time they arrive. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### what is the difference between an external network pentest and a web app pentest An external network pentest covers everything reachable from the public internet under a domain, such as servers, VPN gateways, and mail servers, including only the public-facing parts of web apps like the server they run on and unauthenticated pages. A web app pentest instead goes deep into one application's logic, user roles, and code, surfacing business logic flaws and broken access controls that only show up after login. _Choosing between pentest types gets easier with daily.dev's coverage of application security practices._ ### how fast are attackers exploiting new vulnerabilities after disclosure compared to a few years ago In 2018, only 18.7% of exploited vulnerabilities were hit on or before their public disclosure day; by 2026 that figure reached 86.7%, according to Zero Day Clock data charted by a16z. For the PHP2Shell flaw, Cloudflare recorded thousands of exploit attempts within 10 hours of disclosure, tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the next day. _Tracking how fast exploits spread helps teams on daily.dev prioritize patching before attackers strike first._ ### how does aikido's ai pentesting agent decide what to attack next Each agent starts from a different point on the perimeter and adapts its next move based on what it discovers, similar to how a human attacker would react to a version banner, open port, or leaked file. In one documented chain, an exposed .git folder led to leaked SSH credentials, which worked on a second host, which exposed Azure credentials giving admin access to the cloud tenant. _Developers weighing AI-driven security tools can follow these capability breakdowns on daily.dev._ ## Similar posts on daily.dev - [Adding Aikido AI pentesting to your existing security stack](https://daily.dev/posts/adding-aikido-ai-pentesting-to-your-existing-security-stack-ve7fyuizy) · Aikido Security · 0 upvotes · 0 comments - [More pentesting, same budget, no surprises](https://daily.dev/posts/more-pentesting-same-budget-no-surprises-wnf521hlt) · Aikido Security · 0 upvotes · 0 comments - [Aikido Security bets on AI to make software secure itself](https://daily.dev/posts/aikido-security-bets-on-ai-to-make-software-secure-itself-4moazd3km) · The New Stack · 0 upvotes · 0 comments - [Aikido Machine: on-prem AI pentesting server](https://daily.dev/posts/aikido-machine-on-prem-ai-pentesting-server-izxogxhsz) · Aikido Security · 0 upvotes · 0 comments - [AI pentesting: what it is, and what it can actually find](https://daily.dev/posts/ai-pentesting-what-it-is-and-what-it-can-actually-find-w5c7pfldb) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Aikido launches external network pentesting","url":"https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu"},"datePublished":"2026-10-28T09:11:26.743Z","dateModified":"2026-10-28T09:13:43.806Z","description":"Aikido now pentests a company's external network using AI agents. Given just a root domain, the agents map internet-facing systems like servers, VPN gateways...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1eeec942ee3697ef93a494c192e681d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1eeec942ee3697ef93a494c192e681d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,appsec","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Aikido launches external network pentesting"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aikido-launches-external-network-pentesting-1gq6solvu#faq","mainEntity":[{"@type":"Question","name":"what is the difference between an external network pentest and a web app pentest","acceptedAnswer":{"@type":"Answer","text":"An external network pentest covers everything reachable from the public internet under a domain, such as servers, VPN gateways, and mail servers, including only the public-facing parts of web apps like the server they run on and unauthenticated pages. A web app pentest instead goes deep into one application's logic, user roles, and code, surfacing business logic flaws and broken access controls that only show up after login. Choosing between pentest types gets easier with daily.dev's coverage of application security practices."}},{"@type":"Question","name":"how fast are attackers exploiting new vulnerabilities after disclosure compared to a few years ago","acceptedAnswer":{"@type":"Answer","text":"In 2018, only 18.7% of exploited vulnerabilities were hit on or before their public disclosure day; by 2026 that figure reached 86.7%, according to Zero Day Clock data charted by a16z. For the PHP2Shell flaw, Cloudflare recorded thousands of exploit attempts within 10 hours of disclosure, tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the next day. Tracking how fast exploits spread helps teams on daily.dev prioritize patching before attackers strike first."}},{"@type":"Question","name":"how does aikido's ai pentesting agent decide what to attack next","acceptedAnswer":{"@type":"Answer","text":"Each agent starts from a different point on the perimeter and adapts its next move based on what it discovers, similar to how a human attacker would react to a version banner, open port, or leaked file. In one documented chain, an exposed .git folder led to leaked SSH credentials, which worked on a second host, which exposed Azure credentials giving admin access to the cloud tenant. Developers weighing AI-driven security tools can follow these capability breakdowns on daily.dev."}}]} ```