Topic starter
06/09/2026 9:02 am
TL;DR: Annual red team reports can quickly become stale as attack surfaces change, credentials leak, and new endpoints appear, according to FireCompass. The article argues that continuous automated red teaming is now the more realistic model because attackers do not wait for a yearly assessment window.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “Continuous Automated Red Teaming (CART): How It Works and Why Annual Red Teams Are Obsolete in 2026”.
By the numbers:
- FireCompass reports a false positive rate under 2 percent for CART, versus 40 to 70 percent for DAST tools.
Key questions
Q: What breaks when red team testing is only done once a year?
A: Annual testing breaks down when the attack surface changes faster than the engagement cycle.
Q: Why do leaked credentials make annual red team reports misleading?
A: Because leaked credentials can become active entry points long after a report is delivered.
Q: What do security teams get wrong when they rely only on automated red team tools?
A: Teams often assume automation can fully mimic a skilled attacker.
Practitioner guidance
- Map the real external attack surface continuously Continuously rediscover shadow apps, forgotten subdomains, exposed APIs, and staging environments so the test surface reflects current reality instead of a frozen asset list.
- Require proof-of-exploit for every prioritized finding Treat findings without working proof-of-concept code as hypotheses, and escalate only those that can be reproduced and validated in context.
- Test attack-path chaining across identity and application layers Force red team workflows to demonstrate how one access foothold can pivot into directory services, internal infrastructure, or sensitive application workflows.
Bottom line: Annual red team reports can become stale quickly when the attack surface changes faster than the assessment cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:02 am
Annual red teaming now creates governance lag: point-in-time validation cannot keep pace with environments where endpoints, identities, and third-party dependencies change weekly. The operational problem is not only missed vulnerabilities but missed access paths that appear after the report is signed off. Security leaders should treat continuous validation as the baseline for realistic external assurance.
A question worth separating out:
Q: How should organisations govern autonomous security testing?
A: They should treat the testing agent like any other privileged non-human identity. That means least privilege, narrow scope, full logging, and human approval for sensitive actions. The goal is to make the automation auditable and bounded so it can test production safely without becoming an uncontrolled actor.
👉 Read our full editorial: Continuous automated red teaming exposes the annual red team gap