Your annual pentest report landed in March. By April, three new shadow apps were live. By June, a developer pushed an unauthenticated API endpoint to production. By the time next year’s engagement kicks off, your attack surface has changed so much that the previous report is archaeology, not security. The question more security teams are… Read More »Continuous Autonomous Pentesting: A 5-Step Workflow for 2026
Insights from a closed-door roundtable on AI agent safety and governance, chaired by Bruce Schneier and hosted by FireCompass founder Bikash Barai. Participant comments are kept anonymous by agreement. The most useful thing about this roundtable was that nobody pretended to have the answer. A room of senior security leaders spent an hour on AI… Read More »AI Agents Are Doing Real Work. Governing Them Is the Unsolved Problem
Yesterday, Anthropic shipped Fable 5, the public avatar of its Mythos-class model and the most capable model it has ever released to anyone with a subscription. Fable 5 and the gated Mythos 5 are the same underlying weights. What separates them is a layer of safety classifiers, separate models that inspect every request, and the… Read More »7 Insights: How Fable 5 (Mythos Avatar) Will Change Your Offensive Security Program
AI has already changed offensive security. The open question for security leaders is what to do about it. A recent EC-Council CyberTalks session of the same name addressed the question directly, featuring FireCompass co-founders Bikash Barai and Arnab Chattopadhayay, along with a CISO from a global financial group. What follows is the part a CISO… Read More »FC & ECC Panel – The Mythos Threat Is Real: How CISOs Should Respond
Looking for the full COST definition? This post covers the market analysis. For the complete framework, triggers, and how FireCompass delivers Continuous Offensive Security Testing (COST) you can refer to: www.firecompass.com/continuous-offensive-security-testing When someone tells you they do continuous offensive security testing or COST, ask two questions. Q1: Can it prove the exploit with reproduction steps… Read More »COST vs CTEM: What Continuous Offensive Security Testing Requires