Can you run a real penetration test by pointing a strong AI model at an application and letting it work? It is a fair question, and the honest answer is no, not on the model alone. This article walks through the four things a frontier model cannot do in a live pentest, what has to… Read More »Why an LLM Cannot Run a DAST Pentest, and What Does
Summary of a closed-door CISO roundtable, hosted by CISO Platform with FireCompass, August 2026. Held under Chatham House convention. Senior security leaders spent a session on three questions. What does it cost to run an AI pentesting agent at full speed? What has to be true architecturally before you point one at production. And what… Read More »Implementing Agentic AI Pentesting While Managing Risk and Cost
Introduction A subdomain takeover starts with a decommissioning step nobody remembered to do. A team points a company subdomain at a third-party resource, a CDN edge, a cloud app, a storage bucket, a static-site build, and later deletes or renames that resource without ever removing the DNS record that pointed to it. The subdomain keeps… Read More »Nine Programs, Nine Organizations, One Forgotten DNS Record: How FireCompass’s Agentic AI Penetration Testing Found Subdomain Takeover Risk Across Five Cloud and CDN Providers
Fewer than five open-source offensive security agents existed before GPT-4 shipped. By March 2026 Hadrian’s census counted roughly seventy. The good ones are not thin LLM wrappers. They drive nmap, Burp and sqlmap, read the output, reason about what it implies, and choose the next move. That is closer to how a tester works than… Read More »The Top Open-Source AI Pentesting Tools in 2026, and What Each One Leaves You to Build
Why the same models produce different results, and what a self-hosting team inherits. An AppSec engineer can self-host an autonomous pentest agent this weekend. Clone Strix or PentAGI, plug in an API key, and by Monday it is finding vulnerabilities in staging. The code is good, the licence is free, and the models underneath are… Read More »FireCompass AI Agents vs Open-Source Agent Frameworks