Financial services firms have always operated under the shadow of cyber risk, and penetration testing has traditionally been one of the industry’s most trusted safety nets as a validation mechanism of a firm’s security posture. But the ground is shifting fast. AI has accelerated the tempo of both attack and defence. Criminals are no longer hand-crafting phishing emails or manually probing for weaknesses; they’re using AI to run campaigns at an industrial scale, sweeping entire environments for misconfigurations and exploitable gaps in minutes. What might have taken attackers weeks five years ago now takes only minutes.
Yet the same technology is also reshaping the defensive playbook. And this is crucial. Generative AI and machine learning-driven security tools are challenging the idea that penetration testing is a once-a-year compliance ritual. They point toward a future where testing becomes continuous, adaptive, and woven into day-to-day operations rather than scheduled as an annual event. Criminals are working at rapid speeds made possible by AI tools, and it’s essential that businesses keep pace.
Continuous testing is crucial to stay afloat
Consider the analogy of a ship at sea to explore this notion of annual testing vs continuous testing. When the waters were mostly calm, a ship owner might decide that a single structural inspection each year was adequate. The risks were mostly predictable, the conditions stable, and the likelihood of sudden failure low. That’s the world annual penetration testing was designed for.
But the environment has changed. That same ship is now sailing through constant storms, unpredictable weather, shifting currents, and threats that appear without warning. In those conditions, a once-a-year check isn’t reassurance; it’s wishful thinking. You need continuous testing, continuous validation, and continuous awareness just to stay afloat. The model hasn’t changed because we want it to; it’s changed because the sea has.
Cyber attacks are on the rise
This shifting environment is backed by the data. FCA data released in 2025 show that cyber incidents continue to climb, with ransomware and data-related attacks increasing year on year across financial services. But the rise in cyber attacks isn’t just about volume; it’s about accessibility. AI has lowered the barrier to entry so dramatically that criminals with almost no technical skill can now launch attacks that once required deep expertise.
The old stereotype of a lone, highly skilled hacker hunched over multiple screens for weeks hunting for a single exploitable flaw is fading. Those operators still exist, but they’re now drowned out by a much larger wave of opportunistic attackers using AI-driven tools to automate reconnaissance, craft convincing phishing campaigns, and probe environments at scale. The capability gap has collapsed: non-technical criminals can now achieve outcomes that previously demanded specialist knowledge, and that shift is reshaping the threat landscape faster than traditional defences can adapt.
And the ultimate honeypot for these attackers? Financial services firms with valuable data, lucrative cyber insurance policies and reputations they cannot afford to see damaged.
AI is driving down the cost of penetration testing
But AI hasn’t just made penetration testing faster; it has made it significantly cheaper. Traditional pen tests were expensive because they relied almost entirely on manual effort: days of reconnaissance, manual enumeration, handcrafted exploitation, and extensive reporting. Every hour of human time adds cost.
AI has flipped that model. Modern tools can scan networks, map attack paths, chain vulnerabilities, and generate structured findings automatically, reducing the manual workload by orders of magnitude. Tasks that once consumed a consultant’s entire week can now be completed in minutes, freeing human testers to focus on high-value analysis, validation and exploitation rather than repetitive groundwork. This efficiency has dramatically lowered the cost per engagement and made frequent testing financially viable. Continuous testing is no longer a luxury reserved for the largest firms; AI has made it accessible, scalable, and economically sensible for organisations of every size.
Speed is part of the best protection
Companies operating in the penetration testing space understand the risks of AI-enabled threats, and many are using the same technology defensively. AI-driven tools in the defensive realm are on the rise, enabling pen tests to go faster and further than ever before. And this speed is becoming crucial.
The first penetration test I ever witnessed feels like a lifetime ago. A consultant in a sharp suit arrived with two laptops, one for testing, one for writing the report, and spent two weeks in a meeting room working through every corner of our sprawling network. The final output was a 300+ page report: executive summary, findings, risks, and remediations. It was impressive and necessary, but already outdated. While the penetration test was underway, our internal developers were making changes that the consultant never saw. By the time the report hit my desk, parts of the developer environment had already changed due to business demands, and any possible vulnerabilities introduced during that change window were missed. With the outdated report I had, it fell to me to sift through the findings, determining where to start and prioritise what remediations needed to be actioned first, a time-consuming task. And with the next penetration test scheduled in 12 months' time, that meant any new vulnerabilities remained open for a long time.
When I look at how penetration tests are conducted today, the same testers are still in place, but the toolsets and the speed at which they work are radically different. Work that once required two weeks locked in a meeting room with a human trawling through networks and servers to manually gather findings can now be completed in a matter of hours. AI tools scan networks for vulnerabilities, correlate findings and string together exploits into realistic attack paths a criminal with access might take.
AI isn’t replacing human pen testers; it is empowering them to do far more. Furthermore, many of these tools now also aggregate findings into portals and automatically prioritise remediation, accelerating the work of technical teams. At the same time, businesses are undergoing internal technical change at unprecedented speed. There is a data race underway, pushing financial services firms deeper into cloud platforms and analytics tooling to help visualise data. With multiple projects running simultaneously, the risk of misconfiguration and vulnerabilities increases. This is where continuous testing is so crucial. A penetration test might confirm that a business was secure 8 weeks ago, but 8 weeks later, after possible new tools, updates or cloud deployments, is the business still secure right now?
This question: are we secure right now? Is driving many businesses away from annual penetration testing and towards continuous testing. In fact, I have seen a lot of businesses shift towards quarterly test models. These approaches ensure the business has an up-to-date report, and remediation is tackled faster to ensure assurance.
Why continuous testing is no longer optional
AI has changed the rules of engagement. It has handed unprecedented power to criminals, lowering the barrier to entry and enabling attacks that once required deep expertise to be executed by anyone with an internet connection. But the same technology is transforming the defensive landscape. Pen testers are no longer limited by the speed of manual investigation or the constraints of long engagements. AI-driven tools can map environments, chain vulnerabilities, and surface real attack paths in hours, not months, and that shift has exposed a truth the industry can no longer ignore.
The annual penetration test model is gone. It belongs to a slower, more predictable era that simply no longer exists. Today’s environments change weekly, sometimes daily, and attackers move even faster. The future is continuous testing: always on validation, rapid detection of drift, and real-time insight into whether the business is secure right now. AI may be empowering criminals, but it is also redefining the defensive playbook, and the firms that embrace continuous testing will be the ones that stay ahead of both the technology and the threat.
