A deterministic scanner gives you the same output twice. An agentic pentest does not, and that is not automatically a bug — the environment state, the credentials in scope, and the model's choices all
"Pay per finding" sounds like the buyer-friendly model until you ask what a finding is. The definition is where the economics live, and vendors define it very differently. Disclosure: I work on HackBo
Most teams have tests. Few have tests that would have caught the bug that just shipped. The gap is almost always the same one: the test suite exercises the happy path of each endpoint, with a fixture