Agentic AI may help security teams identify which weaknesses attackers could actually exploit—but continuous offensive testing requires evidence, boundaries, and human oversight.