Attackers exploit in minutes. Most enterprises test their networks once a year.

An attacker moves from a disclosed vulnerability to active exploitation in minutes. An enterprise penetration test — the controlled exercise where a security firm probes a network the way a real attacker would — runs once a year, sometimes less. That gap is the actual story behind Terra Security's preview of agentic internal network testing this week.

The compressed attacker timeline is not hypothetical. Verizon's annual Data Breach Investigations Report has tracked the disclosure-to-exploitation window shrinking for years, with recent editions placing the median for exploited bugs in days and a growing share of mass-exploited flaws hitting in the first hours after disclosure. AI-assisted tooling has pushed the leading edge further, toward minutes — a shift Gartner's 2026 cybersecurity trends forecast, cited inside the Terra announcement, lands on as well.

They sit behind the firewall, which historically meant they could be tested on a slower cycle. They are also where the credentials, service-account tokens, and lateral-movement paths that turn a single bug into a full compromise live. Traditional internal pen tests need on-site staff or persistent VPN, weeks of scoping, and produce a point-in-time report. By the time the report ships, infrastructure-as-code and CI/CD pipelines have already changed the topology the test was scoped against.

The architectural shift the category is heading toward is point-in-time to continuous, and from isolated surfaces to chained findings. The release from Terra Security describes the new capability in those terms: hundreds of specialized AI agents running in parallel with a Human-on-the-Loop for the actions that touch production, triggered the moment code or infrastructure changes, and stitching findings across web apps, external networks, AI systems, and the internal network in the way a chained attacker would. The company says a traditional engagement that took four to six weeks now runs in two to four hours, and that the closed loop runs from exploit through remediation guidance to retest.

The test for any 2026 buyer — including Terra — is whether a vendor is actually selling continuous, chained coverage or just a faster point-in-time scan rebranded with the agentic label. The distinction matters because point-in-time, even automated, freezes the network for the duration of the test and ignores the topology changes that happen between runs. Continuous, chained testing treats the internal network the way an attacker treats it: as a live surface where a low-severity finding on one host can pivot to a critical compromise somewhere else. A faster annual scan does not get you there.

The honest caveat on the source basis: the only signal in the current packet is a vendor release republished through a downstream tech outlet. The "first agentic offensive security platform across all four attack surfaces" framing is Terra's own positioning; the four-to-six-week to two-to-four-hour speed claim is the company's marketing; there is no independent benchmark, customer deployment, or analyst note in the set. A defensible read is that the category is moving in the direction the release describes, and the architectural shift is real — but the magnitude, real-world efficacy, and competitive map are not in evidence yet.

The sharper question for any enterprise running a 2026 pen-test refresh: ask the vendor to walk the test from a single low-severity finding on one internal host through the chained lateral path to a critical asset, on a topology that has changed since scoping. If the answer is a report, the buyer bought a faster point-in-time scan. If the answer is a live run that catches the topology change mid-test, the buyer bought the thing the category is moving toward.