Picus says agentic pentesting proves live attack paths but leaves timing and coverage gaps that require complementary validation methods.