Three-Month Trial Shows AI-Powered Ethical Hacking Costs About the Same as One Manual Pen Test, Reshaping Cybersecurity for Defenders and Attackers
Bengaluru (Karnataka) [India], August 6: FireCompass, an agentic AI platform for autonomous penetration testing and red teaming, today announced that its AI-powered penetration testing agent secured Top 3 positions across multiple HackerOne global leaderboards during a three-month live bug bounty experiment conducted against authorised live production systems.
The achievement demonstrates how AI is making advanced offensive cybersecurity capabilities significantly more accessible, marking a pivotal shift in how organisations approach cyber defence. Operating against real-world production targets not controlled lab environments, the company’s autonomous AI agents independently discovered, validated and responsibly reported vulnerabilities while operating at a cost comparable to a single manual application penetration test.
The findings carry significant implications for India’s rapidly expanding digital economy, where enterprises are accelerating AI adoption while facing an increasingly sophisticated cyber threat landscape. As advanced penetration testing becomes dramatically more affordable through AI, the same economics that enable organisations to continuously identify vulnerabilities can also empower malicious actors with capabilities that were once limited to highly skilled security researchers. For Indian enterprises, this underscores the need to transition from periodic penetration testing to continuous AI-powered security validation. The timing is particularly significant as India’s technology industry is projected to generate US$315 billion in FY26, while headcount is expected to grow by only 2.3%, reflecting a broader shift from labour-led growth towards AI-driven productivity and innovation.
Bikash Barai, Founder and CEO of FireCompass, said: “Our agents had already reached 100% on the benchmarks we tested. This experiment was about what it costs to get into the Top 3 spots in a global bug bounty leaderboard. We reached there with just $5K per month. What it means is that threat actors with a very small investment can be as powerful as the world’s top hackers. This is an opportunity for defenders, but the same economics reach attackers at the same time. The next challenge is not just building more powerful AI. It is engineering the controls, safety, and accountability around it.”
Jay Bavisi, Founder and CEO of EC-Council, said, “We invested in FireCompass because we believed AI would empower cybersecurity professionals, not replace them. FireCompass reached the Top 3 on HackerOne, demonstrating the strength of its technology and engineering. The future of offensive security testing is not AI replacing cybersecurity professionals. It is AI-powered professionals.”
The experiment also demonstrates that while AI is rapidly transforming offensive security testing, responsible deployment is equally critical. FireCompass incorporated multiple safety mechanisms throughout the exercise, including strict enforcement of authorised programme scope, non-destructive validation of vulnerabilities, and limits on request rates, concurrency and operational blast radius. These controls ensured that all testing remained within authorised programme boundaries while maintaining human oversight and accountability.
Bruce Schneier, security technologist, author, Harvard lecturer and FireCompass advisor, said, “The history of security is a history of falling costs. When a capability gets cheap, everyone gets it at once, defenders and attackers alike. This experiment shows offensive AI has crossed that line. The question is no longer whether AI can find real vulnerabilities cheaply; it plainly can. The question now is whether defenders adopt the same capability fast enough, and deploy it with safety and discipline.”
FireCompassʼ harness engineering had multiple frontier models coupled with its purpose-built small language models created by FireCompass. The safety controls included:
- Hard enforcement of each programʼs authorized scope
- Non-destructive validation of vulnerabilities
- Limits on request rates, concurrency, and blast radius
These controls kept the agents within authorised program boundaries. As autonomous ethical hacking becomes more widely adopted, scope enforcement, controlled validation, auditability and human accountability will be as important as model capability.
As autonomous ethical hacking becomes more widely adopted, the company believes that model capability alone will not define the future of offensive cybersecurity. Strong governance through scope enforcement, controlled validation, auditability and human accountability will be equally essential to ensuring AI-powered security testing remains safe, trusted and effective for enterprises.
For leaderboard screenshots and more details, visit www.firecompass.com/blog-ai-penetration-testing-hackerone-top-3.
Methodology note
The experiment was conducted over a three-month period against authorised public bug bounty programmes hosted on HackerOne. FireCompass deployed an automated pipeline of autonomous AI agents to discover, validate and responsibly report vulnerabilities on live production systems within authorised programme scopes. The reported operating cost included AI model usage, cloud infrastructure and human oversight, making it comparable to the cost of a single manual application penetration test.
About FireCompass
FireCompass is an agentic AI platform for autonomous penetration testing and red teaming across web applications, APIs and enterprise infrastructure. The platform discovers shadow assets, multi-stage attack paths, credential reuse, business-logic vulnerabilities and lateral movement opportunities with near-zero false positives. FireCompass is trusted by Fortune 1000 organisations and has been recognised in more than 30 analyst reports.
More at firecompass.com.
If you object to the content of this press release, please notify us at pr.error.rectification@gmail.com. We will respond and rectify the situation within 24 hours.
