# The End of the Engagement Model

## A market thesis on agentic offensive security

For three decades, the offensive-security industry has been organised around a single economic primitive: the engagement. A team of specialists is hired, given a window of weeks, and produces a report. The report lands as a PDF. The PDF ages.

This model worked when applications shipped quarterly and attack surfaces moved at the speed of architecture review. It is now competing against an environment in which production code changes hourly, third-party dependencies update daily, and infrastructure topology is rewritten by a pull request. **The unit of attack has become smaller and faster than the unit of assessment.**

The result is a structural mismatch the market has not fully priced in. CISOs are buying engagements measured in weeks to defend systems that change every minute. Boards receive annual penetration-test summaries that document a system that no longer exists. Compliance teams track remediation against findings whose business context has already shifted.

The industry's response has been to add velocity to the labour. More scanners. More dashboards. More copilots that offer autocomplete to human testers. None of these change the underlying economics, because the bottleneck was never tooling. The bottleneck was the consultant-hour itself.

## A market built on labour, defending a world built on code

Modern offensive-security firms scale the way law firms scale: linearly, by adding senior people. The output of one assessment is not durable. The output of two assessments is not composable. The cost of doubling an organisation's coverage is the cost of doubling its bench.

This was tolerable when application portfolios were small and durable. It is intolerable now. A typical enterprise runs hundreds of internet-facing services, thousands of repositories, and a software-bill-of-materials with tens of thousands of dependencies. The honest answer to "what is your full attack-surface coverage?" has become "the eight percent we tested last quarter."

False-positive fatigue compounds the problem. Static scanners produce noise at industrial scale; the human triage cost dwarfs the scan cost. **Coverage has become aspirational, and confidence has become political.**

Compliance frameworks have adapted by lowering their evidentiary bar. A signed report from a credentialed firm counts as control efficacy, even when the report describes a state of the world sixty days old. The market has tacitly agreed that periodic assessment is the best available proxy for continuous defence, while quietly understanding that it is not.

The consulting layer is structurally disincentivised to fix this. Margins in offensive security are billable hours. A platform that compresses a four-week engagement into a four-hour run is, from a profit-and-loss perspective, a competitor. The firms best positioned to industrialise this transition are the ones most exposed to its outcome.

## The next layer is reasoning, not automation

The honest story of the last twenty years of security tooling is that we have automated what was already automatable. Pattern matching became signature scanning. Heuristics became rule engines. Library checks became software-composition analysis. Each step replaced clerical work, not adversarial thinking.

The work that remained, the work that determines whether a vulnerability is real and what its impact is, demanded reasoning. It required chaining tools, interpreting responses, adapting to anti-patterns, and constructing a coherent exploitation path. That work resisted automation because automation, until recently, could not reason.

That premise is no longer load-bearing. Large-language-model reasoning has crossed the threshold at which it can dispatch tools, evaluate their output, and continue. Tool-use scaffolding has matured to the point that agents can invoke web proxies, terminals, code analysers, browsers, and structured-output validators in sequence without human supervision. Per-token economics have collapsed by more than an order of magnitude in eighteen months.

The honest description of the resulting system is unfamiliar. It is not a scanner with a chatbot front-end. It is not a copilot whispering hints to a human tester. **It is a reasoning system that conducts adversarial work the way a senior consultant would, except that there are a hundred of them, they operate in parallel, and they do not bill by the hour.**

Once such a system exists, the engagement model collapses inward. The unit of work moves from the consultant-hour to the model invocation. Coverage decouples from headcount. The number of times an attack surface is tested in a year becomes bounded by infrastructure budget, not by recruiting pipeline.

This is the transition that has begun, and Aegis is among the platforms already operating on the far side of it.

## A scenario, briefly

At 2:13 in the morning on a Tuesday, an autonomous agent inside an Aegis run notices that a payments API returns the same response shape for `GET /api/orders/4711` regardless of the authenticated user. It does not file a finding. It spawns a child agent to test sibling endpoints. The child finds a privilege-escalation surface on the same service. A third agent constructs a working proof-of-concept that moves a small balance between two test accounts the platform created for itself.

The system logs every step. The model invocations, the tool calls, the chosen prompts, the cost of each decision in cents, the reasoning that led from the initial response shape to the financial-impact estimate. By the time the head of security walks into the building, the report is on her dashboard, the finding is framed in terms of transaction volume rather than CVSS score, and the chain of reasoning is reproducible in full.

The interesting word in that paragraph is not "autonomous." It is "reproducible." **What is new is not that the work happens without humans, but that the work can be audited completely after the fact.**

## Compute economics, not consulting economics

The shift from consultant-hours to compute is not a continuous improvement. It is a category change in cost structure. Once offensive testing is bound by compute rather than by labour, three things become possible at the same time.

First, frequency. An assessment that costs hundreds of dollars rather than tens of thousands can run weekly, on every release, on every pull request. The notion of an annual pentest becomes as quaint as an annual code review.

Second, coverage, which has two axes and the industry usually counts only one. The marginal cost of testing one more service approaches zero, so the honest answer to "what is your full attack-surface coverage?" changes from a percentage to a date. The second axis is depth. An attacker who lands in an application does not stay there, but security tooling is organised by layer, so each boundary is a handoff to a different tool, a different team and a different report. When the unit of work is a model invocation rather than a consultant-hour, the same engagement can follow the attack down through the operating system, the infrastructure and the network, and report what it found at each one in the same language.

Third, leverage for the offensive-security firms themselves. Boutique consultancies have spent decades trying to scale margin against linear staffing costs. A platform-augmented firm charges for outcomes rather than hours, and captures margin that previously belonged to the bench.

The right historical analogy is not "another security product." It is what happened to logistics when shipping became software-defined. Companies that continued to optimise warehouse labour kept their warehouses; companies that re-platformed against software-routed networks ended up moving an order of magnitude more goods per dollar. **The cybersecurity equivalent is unfolding now, and the gap is widening monthly.**

This has uncomfortable implications for the existing offensive-security market. The firms most exposed to repricing are also the ones most able to defend the status quo through procurement habits, framework requirements, and trust relationships built over decades. The transition will not be polite.

## Audit is the control plane

The predictable objection from a sophisticated buyer is that autonomous offensive systems sound like an undocumented liability. How is a board supposed to govern code that decides for itself what to do? How does a regulator review a finding that emerged from a chain of model invocations?

The answer is that the framing is inverted. **Autonomy without auditability is unacceptable; autonomy with auditability is, for the first time, more transparent than the human alternative.** A senior consultant remembers a fraction of what they did during an engagement and writes down a fraction of what they remember. An autonomous system, by construction, records every prompt, every response, every tool invocation, every dollar, and every reasoning step. Aegis exposes this at the granularity of single tokens; each finding carries the chain of inference that produced it; each chain is replayable; each dollar is attributable. The result is an operational substrate governable in ways human-led engagements have never been.

## Three curves, one inflection

The case for now is not that the technology is sufficient in isolation. It is that three curves crossed at the same time. Reasoning quality, measured by what a model will reliably do without supervision, is high enough that exploitation paths can be constructed end-to-end. Tool-use maturity, measured by how reliably an agent invokes the right primitive at the right step, is past the point at which scaffolding fails more often than it succeeds. Token-cost economics have moved a full assessment from "experimental" to "routine."

No one of these curves alone would have produced this category. Their simultaneous arrival has. **The plausible window for early movers in this transition is measured in quarters, not years.**

The question for security leadership is no longer whether autonomous offensive systems will become the dominant assessment modality. That is now a forecast with a small uncertainty band. The question is who runs the first credible engagement against their own environment, sees what falls out, and re-architects their assessment programme accordingly.

## What to do next

Aegis is open to a small number of organisations running a live engagement against their own attack surface under platform-supervised conditions. The engagement is bounded in time and dollars, instrumented end-to-end, and produces an artefact that compares directly against the last conventional pentest of the same scope.

The point of the engagement is not to evaluate a vendor. The point is to see how the assessment economics, reproducibility, and finding quality compare under like-for-like conditions, against the systems an organisation already runs.

**The category is arriving, and the remaining variable is who runs it first.**