Notifications
Clear all
Topic starter
06/09/2026 9:33 am
TL;DR: Annual penetration tests now leave a 362-day exposure window in environments that ship code weekly, while point-in-time tooling still misses exploitable paths and produces high false positives, according to FireCompass. Continuous agentic testing matters because remediation speed and attack-surface change now outrun traditional pentest cadence.
NHIMG editorial — based on content published by FireCompass: Continuous Autonomous Pentesting: A 5-Step Workflow for 2026
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
A: Annual testing leaves long exposure windows between engagements, so shadow apps, forgotten endpoints, and leaked credentials can appear and remain untested for months.
A: Because credentials are a portable trust mechanism.
Q: How do security teams know if autonomous pentesting is improving assurance?
A: Look for better coverage of critical workflows, more findings in auth and authorisation paths, and shorter time from test to remediation.
Practitioner guidance
- Map the live attack surface from attacker starting points Run discovery from organisation name, public DNS, and external telemetry so shadow apps, forgotten subdomains, and exposed API endpoints are captured before validation begins.
- Require exploit proof for every validated finding Do not accept findings without reproduction steps, working proof-of-concept code, and a clear impact statement that distinguishes exploitable risk from scanner noise.
- Prioritise chained identity paths over isolated defects Triage findings that connect into credential reuse, internal admin access, or lateral movement before low-value single-surface issues, because the chain defines the blast radius.
What's in the full article
FireCompass's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step discovery workflow for mapping shadow apps, forgotten subdomains, and exposed APIs from an organisation name.
- Details on working proof-of-concept validation, including how findings are turned into reproducible exploits.
- Criteria for chaining attacks across web apps, APIs, and identity paths into a single remediation narrative.
- Platform guardrails for autonomous runs, including scope controls and expert-in-the-loop options.
👉 Read FireCompass's analysis of continuous autonomous pentesting and red-team coverage →
Continuous autonomous pentesting: what changes for security teams?
Explore further
06/09/2026 9:34 am
Continuous pentesting is really a control problem, not a tooling problem. Annual testing creates a governance gap because the attack surface changes faster than the audit cycle. The right question is whether a programme can continuously validate what is exposed, what is exploitable, and what chains into privilege. That framing aligns with NIST CSF and MITRE ATT&CK better than one-off compliance testing does. Practitioners should treat continuous validation as an operational control, not a periodic report.
A question worth separating out:
Q: Should organisations replace manual pentests with agentic testing?
A: No. Agentic testing is best treated as a high-frequency validation layer that expands coverage and speed, while humans remain essential for scoping, exception handling, and adjudicating complex findings. The practical model is hybrid: automation for breadth and repeatability, humans for judgement and edge cases.
👉 Read our full editorial: Continuous autonomous pentesting changes the red team cadence gap
