AI exposure by occupation, O*NET 15-1299.04
Will AI replace Penetration Testers?
Penetration Testers: AI can already handle 13 of 22 tasks; the work mostly needs a frontier-tier model.
Have a team in this role?
Get your free 10-role sample: send this role and up to nine others, and a founder sends a board-pack PDF within two business days.
Every task, scored
The 22 tasks O*NET 30.3 lists for Penetration Testers, from most to least exposed. 13 reach 60 or more, the level at which AI already handles a task.
| Task | AI exposure | Evidence | Model tier |
|---|---|---|---|
| Configure information systems to incorporate principles of least functionality and least access. | Estimated | Frontier | |
| Discuss security solutions with information technology teams or management. | Estimated | Standard | |
| Gather cyber intelligence to identify vulnerabilities. | Estimated | Standard | |
| Identify new threat tactics, techniques, or procedures used by cyber threat actors. | Estimated | Efficient | |
| Investigate security incidents, using computer forensics, network forensics, root cause analysis, or malware analysis. | Estimated | Efficient | |
| Keep up with new penetration testing tools and methods. | Estimated | Standard | |
| Prepare and submit reports describing the results of security fixes. | Estimated | Efficient | |
| Test the security of systems by attempting to gain access to networks, Web-based applications, or computers. | Estimated | Standard | |
| Update corporate policies to improve cyber security. | Estimated | Frontier | |
| Assess the physical security of servers, systems, or network devices to identify vulnerability to temperature, vandalism, or natural disasters. | Estimated | Standard | |
| Collect stakeholder data to evaluate risk and to develop mitigation strategies. | Estimated | Standard | |
| Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries. | Estimated | Standard | |
| Write audit reports to communicate technical and procedural findings and recommend solutions. | Estimated | Efficient | |
| Design security solutions to address known device vulnerabilities. | Estimated | Frontier | |
| Develop and execute tests that simulate the techniques of known cyber threat actors. | Estimated | Standard | |
| Develop infiltration tests that exploit device vulnerabilities. | Estimated | Frontier | |
| Develop presentations on threat intelligence. | Estimated | Efficient | |
| Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests. | Estimated | Frontier | |
| Conduct network and security system audits, using established criteria. | Observed | Standard | |
| Document penetration test findings. | Observed | Efficient | |
| Identify security system weaknesses, using penetration tests. | Observed | Standard | |
| Maintain up-to-date knowledge of hacking trends. | Estimated | Efficient |
Observed: scored from AI use recorded in the Anthropic Economic Index (June 2026 release), 3 of 22 tasks. Estimated: scored from the task's O*NET 30.3 work activity, 19 of 22. Importance is O*NET's 1 to 5 rating of how central the task is. Model tier is the lowest tier that can do the task under the published rubric; "No tier" marks hands-on work.
The model tier this role needs
A frontier-tier model or lower covers 100% of the role's importance-weighted task work. 100% of the work is something AI can address at some tier.
Efficient, standard and frontier tiers come from the JobRoute model tier reference. The recommended tier is the lowest one that covers 80% of the work AI can address. How the method works.
Wages, employment and outlook
- US employment
- 435,370
- Median annual wage
- $116,580
- Middle half of earners
- $79,370 to $157,500
- Projected change, 2024 to 2034
- +8.2%
Employment and wages: BLS Occupational Employment and Wage Statistics, May 2025, national. Projection: BLS Employment Projections 2024 to 2034. BLS publishes these figures by SOC code, so O*NET occupations that share a SOC code show the same figures.
Adjacent roles
The occupations that reuse the most of this role's skills, with the usual time to move. These are the first places to look when you plan to redeploy or retrain people in this role.
- Information Security Engineers 66% skill overlap, about 12 months to move Exposure58
- Information Security Analysts 66% skill overlap, about 12 months to move Exposure65
- Software Quality Assurance Analysts and Testers 64% skill overlap, about 13 months to move Exposure62
- Security Management Specialists 60% skill overlap, about 14 months to move Exposure43
- Computer Systems Engineers/Architects 56% skill overlap, about 16 months to move Exposure58
Skill overlap and transition time from the JobRoute role adjacency graph on O*NET 30.3 skills.
Questions about Penetration Testers and AI
Will AI replace Penetration Testers?
AI already handles 13 of the 22 tasks O*NET lists for this occupation, at a task exposure of 60 or more, and the role's importance-weighted exposure is 60 out of 100. JobRoute scores tasks, not whole jobs, so the score shows how much of the work changes rather than whether the job disappears. BLS projects employment to change by +8.2% from 2024 to 2034.
What is the AI exposure of Penetration Testers?
60 out of 100 on JobRoute's task exposure measure, the importance-weighted average of the role's O*NET task scores. Higher means more of the work is AI-doable today. 3 of the 22 task scores are observed in the Anthropic Economic Index (June 2026 release), and the other 19 are estimated from each task's O*NET work activity.
Which Penetration Testers tasks can AI already do?
The tasks with the highest exposure are: Configure information systems to incorporate principles of least functionality and least access; Discuss security solutions with information technology teams or management; Gather cyber intelligence to identify vulnerabilities. They are three of the 13 tasks that reach 60 or more.
What AI model tier does this role need?
A frontier-tier model or lower covers 100% of the role's importance-weighted task work. JobRoute assigns each task the lowest tier that can do it under a published rubric and recommends the lowest tier that covers 80% of the work AI can address.
How many people work as Penetration Testers, and what do they earn?
435,370 people in the United States, with a median annual wage of $116,580 (BLS Occupational Employment and Wage Statistics, May 2025). BLS Employment Projections expect a change of +8.2% from 2024 to 2034.
How to cite
Data version 2026-11-02, JobRoute method v1.0.0. Download all occupations or this occupation as JSON. Methodology.
JobRoute (2026). AI exposure: Penetration Testers. Data version 2026-11-02, method v1.0.0. Built on O*NET 30.3, BLS OEWS May 2025 and the Anthropic Economic Index (June 2026). CC BY 4.0. https://www.jobroute.ai/jobs/penetration-testers
Have a team in this role?
Get your free 10-role sample. Send this role and up to nine others, with no employee data, and a founder sends a PDF in board-pack format within two business days.
A founder replies within one business day.