Unit 42 ships always-on AI pentesting. No model finds 40%

The interesting number in Palo Alto's new AI pentesting service isn't what it found. It's what a single model missed. On September 22, Palo Alto Networks launched Unit 42 Continuous Frontier AI Defense, converting its point-in-time Frontier AI Exposure Analysis into an always-on subscription that runs frontier models against your applications, APIs, cloud infrastructure, code repos and network assets continuously. Most of you will not buy this. All of you should read the methodology note buried in it.

What actually happened

The service runs Anthropic's Claude Mythos 5, OpenAI's GPT-5.6-Cyber and open-weight models through what Palo Alto calls a proprietary multi-model harness — routing each security task to whichever model is best suited rather than picking one and living with it. It discovers vulnerabilities, validates real-world exploitability, and produces prioritized remediation guidance. It sells worldwide as an annual subscription; pricing varies by which models you enable and was not disclosed.

The numbers Palo Alto published, from internal deployment and customer engagements:

• No single model catches more than 40% of vulnerabilities. Leading cyber models show less than 10% overlap in what they find.
• Internally, the company says it got over a year's worth of traditional penetration testing results in three weeks, identified 3.2x more high/critical vulnerabilities than legacy methods, and cut mean time to remediate by 51%.
• In customer environments, two of three validated exposures had no known CVE, and 37% rated high or critical.
• One case study describes attackers compressing weeks of intrusion work into under 10 hours — 97% faster than skilled human red teams.

Treat the internal figures as vendor-reported, because they are. The two findings that survive that discount are the model-coverage numbers and the no-CVE ratio.

Why continuous AI pentesting matters for your business

You are not buying an enterprise offensive security subscription. Here's what you take from it anyway.

"No single model finds more than 40%, and models overlap by under 10%" is a general result, not a sales point. It means single-model evaluation of anything — security scanning, code review, contract review, data extraction — is leaving most of the findings on the table. If you run a review agent against your own codebase on one model and call it clean, you have measured one model's blind spots. Running two different-family models over the same input and diffing the results is cheap and catches a startling amount. We do this on client code and the disagreements are consistently where the real problems are.

Two of three exposures having no CVE kills patch-only security. If most of what gets found is misconfiguration, exposed credentials, and broken access paths rather than an unpatched library version, then your dependency scanner is covering the minority case. Check the boring stuff: S3 and bucket permissions, API keys in environment files that shipped to a repo, admin routes with no auth, webhook endpoints that trust the payload.

The attacker-speed number is the actual threat model. If an intrusion chain that took weeks now takes hours, then "we'll patch it next sprint" is no longer a schedule — it's a bet. Rank by exploitability and exposure, not CVSS score.

And the strategic read on the vendor side: security vendors now resell gated frontier models as a service layer. That is the same business model as every AI wrapper, with one difference — the models are the ones you cannot get API access to yourself. Expect more of your security stack to become a model-routing bill.

Sources: Palo Alto Networks, Palo Alto Networks investor relations.