Autonomous Penetration Testing Tool vs second-order (2026)