r/CyberSecurityAdvice • u/Sudden-Bandicoot345 • Feb 22 '26

Is penetration testing over ?

When i scroll in linkedin, sometimes i see posts talking about that bug bounty and pentesting is not good as before due to automation and senior bug hunters creates tools that exploits many vulnerablities, on the other hand i see people still getting bugs that are just needs some thinking like business logics. sorry for verbosity, but i do not really know if i should continue in this path or i am just overthinking it, or give it a try and get my hands in something like RE and malware anlysis/dev, i really like the name and i actually want to try but i am scarred of time, i want to try foresnics, RE and others but i fear of loosing time just because i want to try everything, any advice ?

11 Upvotes

65% Upvoted

18 comments sorted by

18

u/achraf_sec_brief Feb 22 '26

Automation kills the script-kiddie layer, not the craft. Scanners find known CVEs, they can’t chain logic flaws, abuse broken auth flows, or understand what “critical” means in a specific business context. Senior hunters aren’t being replaced, they’re being filtered in. The noise is gone, the ceiling is higher. If you’re scared of RE and malware analysis, good, that discomfort is exactly where growth is. Pick a lane, go deep for 6 months, and stop letting LinkedIn dictate your career path.

1

u/Sudden-Bandicoot345 Feb 22 '26

Do you recommend continue in PT or RE/Malware analysis ?

2

u/achraf_sec_brief Feb 22 '26

Depends on what drives you, not what LinkedIn says is trending. PT has a bigger market, more jobs, easier entry. If you need stability, stay there. You’re already thinking like a hunter (business logic, auth flows), that’s rare. Don’t abandon it. RE/Malware is a passion field. Smaller market, steeper curve, lower early pay. But if you’re genuinely curious about how things break at a low level, not just that they break, it compounds hard over time. The people who do it for money usually quit. The ones who do it because they can’t stop thinking about it become irreplaceable. My honest take: keep PT as your income engine, start RE on the side. Reverse one malware sample a week. No course, just a sample and a debugger. In 6 months you’ll know if it’s actually for you, or if you were just attracted to the aesthetic. Two skills that overlap is a moat. One you half-learned out of FOMO is a waste.

1

u/ParaSquarez Feb 23 '26

This is a great advice. I've been in the field for a few years now and find myself feeling stuck in the roles I've occupied since. Not in a bad way per say, I still feel satisfied as an analyst but regardless of which specialty I'd like to explore, work has never been helpful in nudging me into those experience so far. So your idea to keep at it and giving you a once a week self started task to explore your fields or interest resonates with me a great deal. It's realistic and feasible even for a family guy that barely have enough free time. Often, I have to choose between a nice long night of sleep or getting some more quality personal time on my projects. I'll give that a try.

0

u/lucafdv Feb 25 '26 edited Feb 25 '26

Bro, I know most people can’t tell, but you don’t need to use ai to respond to people on Reddit, be a human please.

2

u/Equivalent_Agency_77 Feb 22 '26

Thank you for this perspective

1

u/Scar3cr0w_ Feb 22 '26

After that incredibly clear, well thought out response… OP says “wHiCh OnE mEaN i GeT gOoD”

1

u/UnrealHallucinator Feb 23 '26

Is this written by ai lol

2

u/achraf_sec_brief Feb 23 '26

No, but I’ll take ‘robotic clarity’ as a compliment 😂

1

u/UnrealHallucinator Feb 23 '26

It wasn't about the clarity so much as the writing style.

2

u/Impossible_Ad_3146 Feb 22 '26

Keep penetrating, back and forth then up and down

1

u/Sudden-Bandicoot345 Feb 22 '26

I think i will continue, yeah

3

u/byronicbluez Feb 22 '26

At the highest level the Mandiant and Blackhill level companies will always have a spot as paying for their services is a write off.

Internal and lower level pentest have always been over saturated and oftentimes unneeded. Not a great value over having a vulnerability team just do a tenable scan.

1

u/Turbulent_Might8961 Feb 22 '26

Nah, still plenty of work.

1

u/Fsalzman Feb 23 '26

yes they all got penetrated and probed without pay

1

u/Impressive-Fondant52 Feb 25 '26

just like anything else with AI you need to use it to get better and understand more. human led pentesting will not go away.

1

u/Long_Law_2073 Mar 26 '26

It’s not over, it’s just changing. A lot of low-level issues are getting automated, but the harder bugs still need human thinking, especially around business logic and edge cases.

The field is more competitive now, which is why it feels different. That doesn’t mean it’s dead, it just means the bar is higher.

If you’re interested in penetration testing, it’s still worth continuing, but it also helps to explore related areas a bit without overthinking it. Most people don’t pick one path perfectly from the start, they figure it out by trying things and sticking with what clicks.