Can Agents Work?

Jobs / Security / 15-1299.04

Penetration Testers

Evaluate network system security by conducting simulated internal and external cyberattacks using adversary tools and techniques. Attempt to breach and exploit critical systems and gain access to sensitive information to assess system security.

US jobs
435,370 (SOC 15-1299 group, "Computer Occupations, All Other")
Median wage
$116,580 a year
Job family
Security

Can agents do the work of penetration testers?

We read the evidence for the whole job family, Security: Nearly all tasks (up from Not yet 12 months earlier)

Agents complete 90% or more of the tasks (or projects) on two direct benchmarks from independent institutions.

Evidence: Cybench, 100% of tasks completed; CyberGym, 99.2% of tasks completed.

7% of this occupation's work, by O*NET work activities, is measured by a direct benchmark (figures for the SOC 15-1299 group).

  • 8%Develop operational or technical procedures or standardsNot measured
  • 6%Advise others on the design or use of technologiesNot measured
  • 5%Direct scientific or technical activitiesNot measured
  • 4%Present research or technical informationNot measured
  • 4%Test performance of computer or information systemsMeasured
  • 4%Analyze performance of systems or equipmentNot measured
  • 4%Evaluate the characteristics, usefulness, or performance of products or technologiesNot measured
  • 4%Design computer or information systems or applicationsNot measured

Benchmarks for this occupation

These benchmarks name this occupation in their job mapping.

Direct evidence

Work benchmarks mapped primary to this family. They set the step when they report how many tasks agents complete.

Benchmarks for the job family

These cover work in security, not always this occupation's tasks.

Direct evidence

Work benchmarks mapped primary to this family. They set the step when they report how many tasks agents complete.

Also relevant

These benchmarks cover part of this family's work, or have no result yet. They do not set its step.

Context only

These benchmarks span many occupations, or they test how agents behave. They give context but do not set the step.

Typical tasks

From O*NET 31.0. Core tasks first. Few of these tasks have a benchmark today.

  • Document penetration test findings.
  • Identify security system weaknesses, using penetration tests.
  • Write audit reports to communicate technical and procedural findings and recommend solutions.
  • Gather cyber intelligence to identify vulnerabilities.
  • Maintain up-to-date knowledge of hacking trends.
  • Keep up with new penetration testing tools and methods.
  • Identify new threat tactics, techniques, or procedures used by cyber threat actors.
  • Conduct network and security system audits, using established criteria.
  • Develop security penetration testing processes, such as wireless, data networks, and telecommunication security tests.
  • Test the security of systems by attempting to gain access to networks, Web-based applications, or computers.
  • Evaluate vulnerability assessments of local computing environments, networks, infrastructures, or enclave boundaries.
  • Prepare and submit reports describing the results of security fixes.
Other job titles for this occupation (37)

Cyber Systems Engineer · Security Consultant · Security Engineer · System Vulnerability Analyst · Threat Hunter · Vulnerability Assessor · Application Security Assessor · Application Security Hacker · Application Security Tester · Certified Tester · Cyber Assessment Tester · Cyber Assessor · Cyber Security Engineer · Cyber Security Tester · Cybersecurity Engineer (Cyber Engineer) · Cybersecurity Specialist · Embedded Tester · Hardware Hacker · Information Security Assessor · Network Exploitation Analyst · Network Security Tester · Penetration Testing Consultant · Risk Tester · Security Application Tester · Security Architect · Security Assessment Tester · Security Automation Tester · Security Consulting Tester · Security Control Assessor · Security Tester · Systems Security Tester · Tester · Vulnerability Analyst · Vulnerability Assessment Analyst · Vulnerability Management Analyst · Vulnerability Management Engineer · Vulnerability Researcher