I was just on a call with an engineer the other day—smart guy, lots of certifications, clearly well-meaning. We were walking through a penetration test report, and suddenly he hits me with this: 

“According to NIST, this pen test isn’t good enough. We need an ethical hacker to sit in a chair and do it by hand.” 

Wait. What? 

So I ask the obvious question: 

“Are you testing your environment for compliance? Or for how it’ll actually get breached?” 

Because here’s the thing that got lost in his well-rehearsed response: hackers aren’t doing this stuff manually anymore. 

That’s not how the world works. Not in 2025. Not even in 2020. 

Real-World Hackers Don’t Sit in Chairs 

The way attackers operate today is terrifyingly simple and brutally efficient: 

  • They build tools.
  • They script the attacks.
  • They automate the deployment.
  • They use AI to optimize the angle of attack.
  • Then they sit back and let the network bleed.

It’s a volume game. It’s a speed game. And it’s absolutely not someone wearing a hoodie, typing away in a dark basement like it’s a bad 90s hacker movie. 

If you’re hiring someone to “sit in a chair and bang on your network,” you’re testing like the attackers did ten years ago. That’s 2015. Wanna know what else was around in 2015? Windows 7. Internet Explorer. And ransomware that still needed someone to double-click a shady PDF. 

Would you still run a 10-year-old laptop to protect your business today? 

No. Because it’s outdated. 

So why the hell would you use a 10-year-old approach to simulate a modern attack? 

Automation Is the Attack 

The attackers figured it out first: scale wins. 

That’s why modern pentesting—the kind that actually simulates how today’s threats work—leverages automation. Not because we’re lazy. Because that’s what the real adversaries do. 

And the best of them? They’ve layered in AI to dynamically shift methods, avoid detection, and evolve mid-attack. 

That’s not science fiction. That’s Tuesday. 

So no, we’re not going to put a warm body in a chair and let them “poke around” like it’s some artisanal red-team tasting menu. We’re going to simulate what hackers are actually doing today—at scale, in real time, with evolving logic that mimics actual threat actors. 

If You’re Selling Manual Pentesting, You’re Selling False Comfort 

Sure, it feels better to say a “real human” did the test. But unless that human is replicating the real-world, scalable, automated hellscape your clients are facing, then what you’re really offering is compliance theater. 

You’re not protecting clients. You’re giving them a stage play with a false sense of safety—and hoping the lights don’t go out. 

The Bottom Line 

If your pen test strategy still involves “guys in chairs,” you’re not doing cybersecurity. 

You’re doing nostalgia. 

It’s time to upgrade the mindset—and the method. 

Because your clients don’t need to pass a test. 

They need to survive an attack.