The only thing that justifies a validation scheme is its ability to provide an accurate quantitative assessment of the thing being measured that can be translated into business value. In the case of security, this would usually be a quantitative assessment of your security relative to a threat model and actionable information that allows either a more accurate assessment of underlying risk or an indication of where to deploy resources or how to deploy them more effectively.
Personally, even if I accept your claim that it is better than a penetration test and less than a team of penetration testers I do not see how this is very useful. Any substantial threat to a commercial entity can easily round up enough resources to be comparable to a team of penetration testers. As essentially any moderately competent team of penetration testers can completely compromise any commercial entity, the actionable information gained from penetration tests on most commercial systems is: "Your system is hopelessly insecure against substantial threats.". Therefore, inserting another level of threat competence below that allowing you determine if you are "hopelessly insecure against insubstantial threats" vs "hopelessly insecure against substantial threats" is not particularly helpful. It would be like testing bulletproof vests against BB-guns, even if it succeeds, it does not tell you anything useful about its effectiveness against the actual threat.
I assume from your comment that you to think that "covering ass" adds value to security, it does not. Because if you, like me, judge this product as being redundant, then what value is truly added? What if a competent team of pentesters is rejected and favor of this tool? Then you made the world less secure. An organization not competent enough to run a security scanner will certainly not see the benefit of this product.
The current status in cyber security is that of safety in engineering three centuries ago: "This bridge is secure because we walked two oxen over it, and it did not collapse.".
"Our bank is secure, because no hacker has stolen our funds yet."
The problem with these automated "agents", just call them scanners, is that they only test for known threats. Just as your vulnerability scanner du jour.
Sometimes an attacker does not need more than a flaw discovered and patched 2 years ago. Regularly I still see important systems in my customers' networks vulnerable to MS17-10. But that is covered completely by vulnerability scanning.
What does this supposedly bring to the table? Blue team training? Network detection validation and tests?
If you are a financial institution the groups that want to target you include sophisticated and determined attackers. They will have techniques not adequately covered by these systems. Or they will just invent a new technique. You don't hamstring these operators by endlessly re-sending their C2's traffic through your network sensors! (Or so I keep telling people rabidly interested in "actor emulation"). They are not stupid, they'll just invent a new technique...
Secondly, holes in your monitoring correlate with holes in your preventive security. You can hardly monitor for an exploit you don't know exists. You can't 'simulate' an attacker living of the land.