Active Directory Control Paths vs ScruteX Agentic Pen Testing (2026)