Summary of a closed-door CISO roundtable, hosted by CISO Platform with FireCompass, August 2026. Held under Chatham House convention. Senior security leaders spent a session on three questions. What does it cost to run an AI pentesting agent at full speed? What has to be true architecturally before you point one at production. And what… Read More »Implementing Agentic AI Pentesting While Managing Risk and Cost
Theoretical vulnerability criticality does not matter. Here is one attack chain our AI agents ran that explains why. A Fortune 1000 organization put one public-facing back-office application in scope, in the tier that handles payouts and ledgers. Tested on its own, that application returned a short list of medium-severity findings. FireCompass agents also tested the… Read More »Case Study: Attack Chaining from an External Web Application to an Internal Network Foothold
Every browser tab runs code the vendor chose to send to it, and everything in that code is visible to whoever opens developer tools, reads a source map, or decompiles the bundle. A recurring and often underestimated class of exposure is what happens when that shipped code, or a config response it calls, carries something… Read More »Shipped to the Browser: How FireCompass’s Agentic AI Penetration Testing Found API Keys and Signing Secrets Hardcoded Into Client-Side Code Across Ten Independent Programs
Fewer than five open-source offensive security agents existed before GPT-4 shipped. By March 2026 Hadrian’s census counted roughly seventy. The good ones are not thin LLM wrappers. They drive nmap, Burp and sqlmap, read the output, reason about what it implies, and choose the next move. That is closer to how a tester works than… Read More »The Top Open-Source AI Pentesting Tools in 2026, and What Each One Leaves You to Build
Why the same models produce different results, and what a self-hosting team inherits. An AppSec engineer can self-host an autonomous pentest agent this weekend. Clone Strix or PentAGI, plug in an API key, and by Monday it is finding vulnerabilities in staging. The code is good, the licence is free, and the models underneath are… Read More »FireCompass AI Agents vs Open-Source Agent Frameworks