Every South African business is about to receive the same pitch – security testing driven by AI. Continuous instead of annual. Cheaper than whatever you’re paying now.

Two of the three claims are true. The third is the one to check before anything is signed.

The number that ended the argument

Cobalt’s AI and Pentesting Pulse Report 2026, published in June, compared two surveys of security professionals a year apart. In 2025, 29% of organisations relied entirely on AI automation for their testing needs. By 2026, that figure had fallen to 9%.

The same research says why. Some 78% reported that fully automated scanning tools had missed critical vulnerabilities in their environment. It’s not a complaint about too many alerts, which any team can work through, but a report that came back clean when the business was not.

“When a scanner raises a false alarm, a security team loses a week chasing it,” says Marthinus Engelbrecht, group chief executive of NEWORDER. “That is irritating. When a scanner stays silent about something real, the business is told it is safe. It files the report, stops worrying, and never looks at that part of the business again. That silence is the expensive failure, and nobody ever finds out it happened.”

A vulnerability is not a way in

The distinction that decides this purchase is not technical. It is the difference between a list and a route.

A vulnerability is a fact about one system. A way in is a sequence: a low-severity flaw in a supplier portal, a connection between two systems that nobody wrote down, a login that should have been switched off, and a finance system three steps away. Automation is good at the first. Every item on the list can be true, and the report can still miss what mattered, because the danger was never in any item. It was in the order.

Chaining findings into a working attack path is Adversary Path Engineering. It is the same work an attacker does, in the same order. Nobody breaks into a business by exploiting a severity rating.

The head-to-head data agrees, and the detail matters more than the headline. In a hacking contest run by Hack The Box in November 2025, teams using AI and teams working without it were set the same 36 problems. The AI-assisted teams solved them at 3.2 times the rate. That gap is driven by the weaker end of the field. Among the top 5%, it falls to 1.69 times. The top-scoring team finished all 36. The best AI-assisted team stopped at 32.

The less skilled the tester, the more automation helps. The more skilled the tester, the less difference it makes. The market has already moved: 47% now prefer a hybrid model, automation for coverage and qualified operators for judgment.

“Automation is used where automation is genuinely better, which is breadth and repetition,” Engelbrecht says. “Every finding is then confirmed by a qualified operator before it reaches a client. That is Human Validation at Scale, and it is the difference between a report and an assessment.”

A clean report is not the same as a clean business

The offer is genuinely attractive. Testing that runs continuously without a scarce specialist is a serious proposition in a country where the CSIR found 63% of cyber security roles are empty or only partly filled.

If a test misses the route an attacker would use, there is no warning. It comes back with nothing in it, which reads exactly like a good result. Nothing looks wrong until something is. That is worse than no testing, which at least leaves a business appropriately worried.

“An empty report is the easiest thing in the world to accept,” Engelbrecht says. “It costs less, it arrives faster, and it tells you nothing is wrong. The trouble is that a test which found nothing and a test which missed everything produce exactly the same document.”

King V, in force for financial years starting on or after 1 January 2026, puts the governance of data, information and technology on the board. A company that cannot say what was tested, by whom, and what was left out is answering to that.

Ask what they actually did

Most buyers, faced with this, look for a certificate or an accreditation. A certificate is worth having, but it describes the company, not the work. It tells you nothing about your own test: what was done, or who did it.

Five things answer that, and any good provider can produce all five. How they went about the test, written down. The name of the person who ran it. The route they found through your systems, and where it ended up. Proof that a person, not a tool, confirmed each finding. And a retest showing the route is closed.

“We have been doing this since 2010, and we hold ISO/IEC 27001 certification that any client can ask to see,” Engelbrecht says. “But a certificate is not the proof that matters. Ask us for those five things. Then ask every other provider you are considering. The ones who cannot produce them will explain to you why they are not necessary. Nobody who can produce them ever says that. It is how you spot the ones selling a document instead of a test.”

Three questions before you sign

No owner needs to resolve the argument about artificial intelligence. They need three answers, in writing:

What did the tool do, and what did a person do? A provider who cannot draw that line either does not know, or would rather you did not.
Did anyone chain the findings, or were they only listed? A list ranked by severity is inventory. Ask to see the path an operator built through it, and what it reached.
Who carries the cost if the test misses a real risk? The answer reveals what a supplier actually believes about their own product.

“If nobody chained anything,” Engelbrecht says, “the business has been handed what an automated system believed about its environment on the day it ran. Nine percent of this market still runs on that alone. There is a reason the other ninety-one percent stopped, and it is not nostalgia.”

About NEWORDER
NEWORDER is a tactical managed cyber security company founded in 2010, working across Africa, Europe and the Middle East, and expanding into the United Kingdom through its Isle of Man global office. The company holds ISO/IEC 27001 and ISO 9001 certifications.