Then and now
Jun 17th, 2026 by Jesper Kråkhede
In November 2018 I wrote about a pentester who arrived in a long black coat, promised to become domain admin within hours, and came down to the cafeteria after an hour and fifty three minutes to ask for a user account. Forty five minutes later he gave up on that too. It is still one of my favourite stories.
Let me compare that with today.
Then, a penetration test was a person, booked months in advance, for a week. If he wasn´t available, the go live was postponed. I complained about it in a post called ‘Who shot my pentester’.
Now, red team AI agents can probe an environment continuously. They don´t need a calendar, a coat or coffee. They look for attack paths every day, not once a year.
Then, the defence was a red forest, ESAE, and Azure ATP telling me in real time what the pentester was trying. I was proud of it, and I still am.
Now, the enterprise access model has replaced ESAE, and the detection is done by connected tools that see identity, endpoint, email and cloud together, with agents that can investigate on their own.
Then, the result was a report with a list of findings, many of which we had seen the year before.
Now, a finding can go straight to a fix, sometimes automatically.
What hasn´t changed? The basics. The pentester failed in 2018 because we had done the boring work: tiering, protected admins, monitoring. The AI agents will fail today for exactly the same reason.
The tools changed. The fundamentals didn´t.