Firecompass

FireCompass is a cybersecurity software company that sells a SaaS platform for offensive security testing. Its agents discover an organization's external attack surface starting from the company name alone — including shadow applications, forgotten subdomains, API endpoints extracted from JavaScript files and traffic, exposed databases, cloud buckets, code leaks, risky open ports and credentials leaked on the deep and dark web — and then run penetration tests against web applications and APIs. Findings are exploit-validated: the platform attaches a working proof of exploit, steps to reproduce and ready-to-run Python, and maps issues to the OWASP Top 10 (2025) with severity and business impact.

Beyond single-issue testing, the platform chains validated findings into multi-stage attack paths that mimic real intrusions: credential reuse across services, app-to-app and app-to-network or app-to-identity lateral movement (including Active Directory), and privilege escalation to admin or root, visualized as a live MITRE ATT&CK-aligned attack-path graph. Published chains include an exposed .git directory leading to database credential extraction, SSH root access via credential reuse and database exfiltration; a UAT auth token in a JavaScript file granting production access; and WAF bypass through origin-server discovery. Testing is triggered by events such as a code push, a newly discovered asset, a newly disclosed CVE (validated within about 24 hours) or on demand, and can also be aligned to CI/CD. Governance features include transparency into agent plans and actions, scope control, safe exploitation designed not to disrupt production, and full audit trails intended to evidence SOC 2, PCI DSS 4.0 and ISO testing cadence requirements.

The broader product line spans web and API automated penetration testing, infrastructure penetration testing across networks, servers and cloud, Continuous Automated Red Teaming (CART), penetration testing as a service with an expert-in-the-loop option, and continuous threat exposure management (CTEM) with attack surface management. The company holds a USPTO-awarded patent for its automated red teaming technology.

Founding story

Founded in 2019 by Bikash Barai and Priyanka Aash, with Arnab Chattopadhayay as co-founder and VP of Emerging Research. Barai previously founded iViZ, an IDG Ventures-backed company acquired by Cigital (now part of Synopsys), described as the first company to move ethical hacking to the cloud; Aash previously co-founded CISO Platform. The founding premise was that organizations test only some assets some of the time while attackers probe all assets continuously, motivating continuous automated red teaming.

Business model

FireCompass sells a subscription SaaS platform, marketed on a per-application cost basis (it cites under $1,000 per application versus $2,400–$10,000 for manual testing) and offering an optional expert-in-the-loop service layer for business-logic testing and compliance acceptance.

Software-as-a-service subscriptions for continuous penetration testing, red teaming and attack surface management, with a paid expert-in-the-loop penetration-testing-as-a-service option.

Traction

The company reports Fortune 500 customers, 100% results on public benchmarks (XBEN 104/104, Acuart 12/12, DVWA), under 2% false positives, and internal evaluations in which its agents outperformed its own top researchers 60–70% of the time; it also states its AI agents reached HackerOne's Top 3 on $5,000 a month. A Fortune 500 case comparison cites a move from 200 of 2,000 applications tested annually at about $5,000 per app with 2+ week lead times to near-full surface coverage at under $1,000 per app with 1-day lead time.

Latest developments

FireCompass announced a $20 million strategic investment from EC-Council, creator of the Certified Ethical Hacker program, out of EC-Council's $100M Cybersecurity Innovation Fund, to fund R&D, hiring across engineering, research and customer-facing roles, and global go-to-market expansion. Its website now identifies the company as an EC-Council ecosystem company and markets an agentic AI penetration testing platform, citing inclusion in a leading research firm's 2026 Continuous Offensive Security Testing category.