Skip to content

Threat Research

Autonomous AI Security Testing graphic showing an AI attack swarm for Web App and API security

Field Notes from Black Hat and DEF CON 2026: What Changed in the Attacker Playbook?

Almost nothing in the attacker’s toolkit is new. The vulnerability classes on display at Black Hat USA 2026 and DEF CON 34 were the same ones security teams have tracked for a decade: request smuggling, SQL injection, SSRF, broken object level authorization. What changed is the economics. Attacks that used to need a specialist and… Read More »Field Notes from Black Hat and DEF CON 2026: What Changed in the Attacker Playbook?

Autonomous AI Security Testing graphic showing an AI attack swarm for Web App and API security

What Recent Autonomous Hacking Incidents Mean for Web App and API Security

At Black Hat USA 2026 and DEF CON 34, one theme was ever-present in both the briefings and the hallway conversations alike: autonomous AI threat actors are actively executing multi-stage attacks. Under permissive evaluation conditions, AI agents have already demonstrated the ability to escape sandbox constraints, establish covert communication channels across third-party tools, and systemically… Read More »What Recent Autonomous Hacking Incidents Mean for Web App and API Security

Old Web Bugs, New Blast Radius: What Vegas 2026 Means for API Testing

Old Web Bugs, New Blast Radius: What Vegas 2026 Means for API Testing

Three vulnerability classes I’ve spent most of my career testing for turned up at Black Hat and DEF CON this year, wearing AI costumes. CSP bypass. SSRF. HTML injection race conditions. Every one of them was written off as solved; every one of them was reachable again. The clearest example was SearchLeak, disclosed by Varonis… Read More »Old Web Bugs, New Blast Radius: What Vegas 2026 Means for API Testing

Case Study: Attack Chaining from an External Web Application to an Internal Network Foothold

Theoretical vulnerability criticality does not matter. Here is one attack chain our AI agents ran that explains why. A Fortune 1000 organization put one public-facing back-office application in scope, in the tier that handles payouts and ledgers. Tested on its own, that application returned a short list of medium-severity findings. FireCompass agents also tested the… Read More »Case Study: Attack Chaining from an External Web Application to an Internal Network Foothold

Nine Programs, Nine Organizations, One Forgotten DNS Record: How FireCompass’s Agentic AI Penetration Testing Found Subdomain Takeover Risk Across Five Cloud and CDN Providers

Introduction A subdomain takeover starts with a decommissioning step nobody remembered to do. A team points a company subdomain at a third-party resource, a CDN edge, a cloud app, a storage bucket, a static-site build, and later deletes or renames that resource without ever removing the DNS record that pointed to it. The subdomain keeps… Read More »Nine Programs, Nine Organizations, One Forgotten DNS Record: How FireCompass’s Agentic AI Penetration Testing Found Subdomain Takeover Risk Across Five Cloud and CDN Providers

Use Cases
Technology
About
Partner
Resources

FireCompass – An EC Council Ecosystem Company.
©2025 . All Rights Reserved.

Firecompass ranked #1 AI on HackerOne. Read more →