Enterprise penetration testing in 2026: attackers break out in 29 minutes and use AI at scale, so annual testing no longer matches the threat.