off-by-slash vs Strike Human-Led Pentesting (2026)