Automation index

How much of a Penetration tester’s job can AI already do?

A scan and a template report come earlier. Finding the weird chain, and not taking production down, do not.

This percentage does not predict how many people will lose their jobs.

Task comparison

IS WORK OVER?

26%

AI can already do 26% of this job.

#207 / 633

Penetration tester

Task weights are our estimates based on O*NET frequency data, not time shares published by O*NET.

The time saving for each task is estimated separately.

Task	Share	AI	Points
Recon, scans and enumeration. Estimate No public source provides a precise figure. This is our estimate.	20%	42%	+8.4
Write the report, evidence and CVSS. Estimate No public source provides a precise figure. This is our estimate.	18%	38%	+6.8
Exploit with judgment and not break the business. Estimate No public source provides a precise figure. This is our estimate.	18%	18%	+3.2
Debrief with the client and retest. Estimate No public source provides a precise figure. This is our estimate.	16%	15%	+2.4
Choose scope, rules and what is off limits. Estimate No public source provides a precise figure. This is our estimate.	14%	16%	+2.2
Research 0-days, labs and keep the craft. Estimate No public source provides a precise figure. This is our estimate.	14%	18%	+2.5
Total	100%		25%

Modelled workweek: 100% · Public evidence: 0% · Estimate: 100% · Confidence: Low

IS WORK OVER?

29%

#58 / 633

Data protection officer

Task weights are our estimates based on O*NET frequency data, not time shares published by O*NET.

The time saving for each task is estimated separately.

Task	Share	AI	Points
Processing records, clauses and DPIAs. Estimate No public source provides a precise figure. This is our estimate.	18%	48%	+8.6
Policies, processor contracts and transfers. Estimate No public source provides a precise figure. This is our estimate.	16%	40%	+6.4
Data-subject rights, internal queries and training. Estimate No public source provides a precise figure. This is our estimate.	16%	28%	+4.5
Incidents, notification and the call to the regulator. Estimate No public source provides a precise figure. This is our estimate.	18%	18%	+3.2
Vendors, cookies and new processing. Estimate No public source provides a precise figure. This is our estimate.	16%	22%	+3.5
Independence, board report and liability. Estimate No public source provides a precise figure. This is our estimate.	16%	14%	+2.2
Total	100%		28%

Modelled workweek: 100% · Public evidence: 0% · Estimate: 100% · Confidence: Low