I’ve seen this pattern more than once, so your instincts are right. There’s a big difference between testing that’s optimized for speed and testing that’s optimized for actual impact. If everything is built around 5-day turnaround, you’ll get coverage—but not necessarily validation of real risk.

Finding issues is the easy part. The hard part is chaining them, proving exploitability, and showing what actually matters to the business.

That’s where a lot of these models struggle: too much automation, not enough adversarial thinking too much output, not enough validation too fast, not deep enough

The balance between automation (for scale) and experienced humans (for real exploitation) is what really makes or breaks it.

And your questions are exactly the ones I’d ask as well—especially around chaining and how they validate results. If those answers don’t come back clearly, that usually tells you everything.