Thanks to AI, software teams now ship hundreds of code changes a day, often hour by hour.
Attackers probe systems around the clock, every day of the year. Yet, most companies in Malaysia still test their security only annually or quarterly, yet argue even that it is too costly and time-consuming.
Let that sink in: your engineers ship code nonstop, attackers never take a day off, yet defenders show up for just two weeks a year. That's a disaster waiting to happen.
Why teams settle for less testing
So why doesn't everyone test constantly? Two reasons every company knows well.
First, humans are slow. Before anyone touches your app, there's scoping, finding a vendor, scheduling, the test itself, then the report. From our years on internal security teams, we felt this more than anyone: the pentest cycle often takes twice as long as a release cycle. By the time the report lands, the feature it tested has already been updated, and new ones are live. For a small feature release, the test can outlast the feature itself. And because pentest doesn't bring in revenue, the testing quietly loses every scheduling fight against work that does. Eventually, someone signs a risk acceptance form and everyone moves on.
Second, cost. Business exists to make a profit, and security is no exception. Everything comes down to return on investment. Pentests are typically priced in mandays. Relying on humans for every step of a pentest is like driving an exotic supercar in a traffic jam, incredible capability, but mostly sitting idle, and you're paying for every idle minute. That premium is baked into the price whether it produces value or not.
None of this happens because teams are careless or making mistakes. It's the only math the current model allows.
AI changes the math
Here's our position: annual or quarterly pentest is dead. Monthly or even weekly pentesting should be the norm. With AI, it can be.
Nearly every technique and piece of knowledge in offensive security is either already in the training data of large language models or can be codified into AI workflows. In our own internal testing, we see days of reconnaissance compressed into hours, and multi-week pentests into days. We'll publish detailed benchmark results soon!
Speed is only half the story. The bigger shift is scale. AI doesn't get tired, doesn't queue, and can run many assessments in parallel, like cloning your best tester ten times over. When the cost per test goes pennies on the dollar, testing every release stops being a luxury and becomes the obvious default.
Built for how you actually ship
This isn't just a theory for us, we've built the toolings.
Most modern companies don't keep all their code in one place; teams split work across many repositories. G4WAIN is designed for exactly that: it analyses code across repository, preserving service topology and evidence-backed flows, so testing can focus on the relevant cross-service paths (release-diff testing is planned in the future version). G4LAHAD then runs the targeted tests on those vulnerable paths. Small release, small test, done fast.
No source code to share? G4LAHAD also runs black box. It emphasises information gathering and multi-round attack planning, prioritising comprehensiveness over speed. It still finishes faster than a human would.
The pricing follows the cost structure: starting from RM3,000 for a typical black box web application. Subsequent tests get cheaper. We expect to keep pushing that price down as the products improve.
Where humans still belong
Humans are the most expensive part of a pentest, but we're not removing them. We're moving them to where they matter most: orchestrating multiple assessments at once, setting strategy, and reviewing results instead of executing every single test by hand. The rest is codified into AI workflows that run it over and over, at a consistency no human shift schedule can match.
This is a fundamental change in cost structure, not a race to the bottom on price. A price war buys market share and eventually burns out; rebuilding the cost base lets you charge less and deliver more sustainably.
We're not claiming to be fully autonomous. "AI-only" security testing sounds great in a pitch deck, but the recent OpenAI x Hugging Face incident is a reminder of why it is not enough: an autonomous agent under evaluation reportedly escaped its testing environment and conducted a multi-stage intrusion into Hugging Face's infrastructure while pursuing an evaluation objective.
AI can accelerate reconnaissance, testing, and analysis at machine speed, but decisions about what to test, what findings mean, when to stop, and what poses real risk still require human expertise. The winning model is hybrid: AI for speed and scale, humans for judgment, guardrails, and accountability.
What this means for companies
If your company ships software constantly but only tests once a year, that gap is where risk builds. Until now, closing it wasn't affordable. We've changed the economics and speed of pentesting. Now, the decision is yours.