• The federal government spent nearly $10 billion placing more than 100,000 federal workers on paid administrative leave for extended periods last year, a sixfold increase from two years prior driven largely by the Trump administration’s deferred resignation program aimed at encouraging feds to quit public service.

    A new report from the Government Accountability Office found that around 70% of that money, or $6.7 billion went to feds who opted into the DRP, a program by which agencies paid employees to stay home, in exchange for their resignation by September 2025—or December of that year, for retirement-eligible workers. While federal employees took 4 million workdays worth of leave in 2023 and 4.4 million in 2024, that number ballooned to 21.6 million workdays last year.

    “Paid administrative leave usage peaked in July 2025 at nearly 3 million workdays; approximately 2.5 million of those workdays were associated with the deferred resignation program,” GAO wrote. “In 2023 and 2024, fewer than 600 federal employees took more than 90 workdays of paid administrative leave; in 2025, almost 100,000 employees took more than 90 days of paid administrative leave.”

    The deferred resignation program came shortly after the Office of Personnel Management issued long-awaited regulations implementing the 2016 Administrative Leave Act, a law aimed at curbing the use of paid administrative leave.

    OPM told agencies that those regulations would not take effect until September 2025, and later proposed a new rule codifying workforce realignment as a valid use of paid leave. OPM’s current guidance for agencies considering a deferred resignation program is to cap the period of paid administrative leave at 12 weeks.

    GAO noted that its estimates regarding the costs of leave approved in connection with the deferred resignation program and other workforce restructuring efforts are likely a modest overcount. That’s because employees commonly misreport similar forms of paid time off, such as for a federal holiday or a doctor’s appointment, as well as the fact that OPM has not set up a dedicated leave category for leave connected to a workforce restructuring effort.

    That means policymakers can’t know whether the Trump administration’s workforce reductions are actually reducing the cost of government, the report found. OPM Director Scott Kupor has previously said the DRP would save taxpayers $20 billion each year.

     “To calculate the long-term government-wide savings of workforce reduction efforts, OPM needs to know the short-term costs of using paid administrative leave,” GAO wrote. “[Without] an accurate understanding of how much paid administrative leave costs the federal government, there is no way to accurately determine to what extent the government-wide cost-savings goal is being met. OPM officials stated that they have no plans to create an additional subcategory of paid administrative leave associated with workforce reductions.”

    GAO recommended the OPM acknowledge the data reliability issues inherent in its public-facing paid leave data, as well as create a new category in federal payroll systems to report workforce-reduction related paid leave. In its response, the dedicated HR agency reversed course and said it would begin the process of creating a new leave category to better track the usage of and reasoning for paid leave.

    “OPM agrees that a dedicated administrative leave data element for workforce reduction efforts would enable more timely reporting on its use and simplify future analysis,” Kupor wrote. “OPM will begin the process of developing a new paid administrative leave category focused on workforce reduction efforts, in coordination with agencies and payroll service providers.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Cyber Command, the Pentagon’s combatant command responsible for planning and conducting military cyberspace operations, has a new artificial intelligence lead, a spokesperson confirmed on Tuesday. 

    “U.S. Cyber Command welcomes Rear Adm. Ronzelle Green as the Command’s new Chief Artificial Intelligence Officer and thanks Brig. Gen. Reid Novotny for his leadership and service,” a representative for the combatant command told Nextgov/FCW.

    Green, who has worked at the National Geospatial-Intelligence Agency for roughly three years — most recently as its director of geospatial intelligence innovation and research — is Cyber Command’s second-ever AI head. Novotny was the first official tapped for the position last November and served in a dual role as CAIO and as cyber force generation lead for the Pentagon.

    The Record first reported the news of Green’s new role.

    In a LinkedIn post last year announcing his new position, Novotny said “part of my role is embracing AI because like anything new, it is not the technology but yet the culture that is difficult to change.”

    Novotny further outlined his approach to adopting AI during an April conversation with Axios, saying that he was solely focused on providing Cyber Command’s personnel with the best AI capabilities, regardless of their origin.

    "To survive anywhere, just in case our operators want an open-source, made-in-China model or something very boutique, we have to create the infrastructure and that ability to be agile — no politics,” he said at the time.

    In addition to his prior work at NGA, Green also brings more than 30 years of IT experience in the private sector and within intelligence community agencies to his new role as Cyber Command’s CAIO. He previously served as the Defense Counterintelligence and Security Agency’s chief information officer from 2020 until 2022, and has held roles within the Pentagon and National Counterterrorism Center throughout his career. Green is also a senior officer with the U.S. Coast Guard Reserve. 

    Cyber Command is led by Gen. Joshua Rudd, who also serves as head of the National Security Agency in a dual-hatted leadership role. NSA and Cyber Command, however, have taken somewhat differing approaches in their adoption of and focus on AI. 

    Under Rudd’s watch, NSA is in the process of a major reorganization that would establish five mission centers focused on AI, China, cybersecurity, combat support and global intelligence. The planned creation of the AI-focused center comes after NSA officials have voiced support in recent months for the use of more AI tools to bolster the agency's cyber and intelligence analysis operations.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NATIONAL HARBOR, Maryland—The advance of Chinese and Russian anti-satellite capabilities led the United States to admit it has weapons in space, the Space Force's top officer said on Tuesday, adding context to Monday’s bombshell revelation by the Air Force secretary.

    Deterrence remains the Space Force’s goal, but the service will pursue it from a “position of strength,” Gen. Douglas Schiess said during a keynote address at the Air, Space, and Cyber Conference here. 

    On Monday, Air Force Secretary Troy Meink revealed the U.S. military has “on orbit, space-control weapons.” Schiess, who took over as chief of space operations less than two weeks ago, spoke to reporters after his keynote on Tuesday.

    “We've talked about you know them being able to grapple a satellite and move it to a different orbit,” he said. “So, I think at this point, we are trying to say that we also need capabilities to not only defend the joint force from space-enabled attack, but defend our assets. And so, I think it was time that within the Department of War we talked about it, and it's time to talk about that we have the capabilities to make sure that we can do what the joint force needs.”

    During his keynote, Schiess said the U.S. military relies on space assets for operations like the current war on Iran, that guardians are already prepared for orbital warfare, and that more money is needed for current and future operations.

    “The Joint Force made it clear: without the Space Force's capabilities, the Joint Force could not and would not move forward,” Schiess said. “During Operation Epic Fury, our components, notably at U.S. Central Command and Space Command, with support from our components at European Command and Pacific Command, demonstrated that guardians are not supporting from the sidelines as a nice-to-have, but we are delivering space power directly into the fight as a need-to-have.”

    Schiess highlighted one guardian in U.S. Central Command with the 42nd Electronic Warfare Detachment who “waged electromagnetic warfare against a determined adversary” during Operation Epic Fury. 

    “Even as alarm red sirens were blaring and incoming missiles targeted her site, she courageously held the line, protecting forces, denying adversary capability, and delivering space effects until her commander had to literally pull her from the console to safety,” Schiess said.

    The CSO said the Space Force has been flexing its capabilities in outer space as well. He highlighted the service’s recent Victus Haze exercise, in which Rocket Lab quickly launched a space vehicle whose  satellite chased after True Anomaly's spacecraft.

    “This particular Victus Haze mission earlier this year demonstrated the ability to launch and respond to an on-demand, on-orbit threat in just 17 hours,” the general said. “Space Systems Command, our industry partners, and Combat Forces Command proved to the world that if an adversary targets the United States Space Force, we have the capability to deliver a swift response, and we are going to continue to work on getting faster and faster.”

    Schiess said those current and future fights highlight the need for more resources.

    “So, looking ahead, we must expand that advantage. We must build a sustained pipeline of guardian talent, equipped with the appropriate training and the kit and advanced capabilities, to ensure our joint force is fully powered by space expertise.” he said. “We must ensure today, tomorrow, and for as long as we have the pleasure to serve, that our joint force can execute because guardians are there, both at home and abroad, and in harm's way.”

    Space Force has grown quickly since its founding in 2019, but this year, the Pentagon is asking Congress to allocate $71.3 billion for the service for the fiscal year that began more than two weeks ago. It would be the biggest single-year funding increase for a service branch, by percentage, since 1952, according to the Aerospace Corporation.

    “Space is both a battlefield and the backbone of our joint force. We face determined and credible adversaries who are building and building counter-space systems at incredible speeds to target directly the United States state's space advantage,” Schiess said. “So that is why we don't just monitor the domain; we stand ready to defend it. So let me be crystal clear: today, Guardians operate on-orbit weapons that can defend the joint force against space-enabled attacks, and in the coming years, with the resources entrusted to us, by the way, we need your help, Congress-we will make disciplined and responsible choices about how we build and sustain our combat advantage, which means scaling our ability to respond to threats.”

    It’s not clear whether Congress will grant the request. The White House wants $1.15 trillion through the normal defense-budget process and an additional $350 billion through reconciliation—a controversial and partisan budget maneuver never used for defense funding before last year. The Trump administration is pressing the GOP-led Congress to relent by proposing to use reconciliation to fund some major Space Force programs, such as the Air Moving Target Indicator and the space data network, and the vast majority of funds for the Golden Dome missile defense program.

    In the meantime, 10 percent of the service’s programs are on hold because Congress hasn’t passed a fiscal 2027 defense spending bill, Schiess told reporters. The federal government is currently operating under a stopgap funding measure that will elapse on Dec. 11.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran’s intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is controlled via the Telegram messaging app and can copy a target’s emails and chat messages, take screenshots, and activate the microphone to record

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed BambooToken, is assessed to be active since at least February 2023 and put to use in attacks targeting organizations across Asia and South America.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has begun routing some organic Search result links through opaque google.com/goto?url=… redirects, reducing users’ ability to independently inspect a destination URL before clicking. The change appears designed to raise the technical and financial cost of mass scraping. However, it also weakens a long-standing, basic anti-phishing habit: hovering over a link to verify where it […]

    The post Google Search Makes It Harder to See Where a Link Really Goes Before You Click appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Phishing operators are increasingly shifting away from malware-laden attachments and toward trusted delivery services, authenticated domains, and multi-stage URL cloaking designed to defeat conventional email inspection. The continuously running VBSpam comparative test evaluated ten public full email-security products and one open-source solution against wanted, unwanted, and malicious mail streams. The assessment was conducted under the […]

    The post Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Sep. 15, 2026

    – Read the full story from BreachLock

    Summary

    • Six vendors run autonomous penetration testing as a standalone product today:
      • BreachLock (Breach360): Trains its AI on 40,000+ real pentests to chain exploits across network and web assets, using human-in-the-loop approvals and optional reviewer sign-off for production safety.
      • Pentera: Delivers continuous, safe-by-design AI exposure validation and automated red teaming directly in live production environments.
      • Astra Security: Combines an autonomous AI engine that exploits web, API, and cloud flaws with human researcher validation and developer integrations.
      • Horizon3 (NodeZero): Operates 100% agentless, fully autonomous pentesting in production by continuously chaining real-world exploits without human intervention.
      • XBOW: Acts as an autonomous AI hacker, executing multi-step attack chains against apps and APIs to deliver verified, reproducible proof-of-concept exploits.
      • Synack / NetSPI: Pairs agentic AI (Sara) for automated recon and exploitation with NetSPI’s PTaaS and the vetted Synack Red Team for expert validation.
    • For the purposes of this list, autonomous penetration testing means a platform independently executes a full attack chain, from reconnaissance through exploitation and lateral movement, without a predefined playbook.
    • Vendors now use automated, agentic, AI pentesting, and exposure validation almost interchangeably, which makes the category difficult to evaluate.

    Top Autonomous Penetration Testing Companies in 2026

    As of this writing, these six vendors run autonomous penetration testing as a standalone product, meaning the platform independently executes a full attack chain, adapts instead of following a fixed script, and covers meaningful breadth across environments.

    BreachLock

    Breach360, by BreachLock, is built on intelligence from more than 40,000 real-world pentests, and it shows in how the solution behaves. It chains weaknesses, tests business logic, and pivots the way a senior pentester would, trained on real engagement data at scale. Breach360 autonomously executes penetration tests on internal and external, network and web environments in a single workflow. Scope, severity thresholds, approval gates before privilege escalation or lateral movement, and a kill switch keep that autonomy production-safe, with the option to route findings through certified BreachLock pentesters for expert validation.

    Request a demo of Breach360.



    BreachLock’s Breach360 autonomous pentesting maps attack paths from reconnaissance through exploitation, credential recovery, and confirmed lateral movement.

    Pentera

    Pentera positions its platform around AI-driven exposure validation, offering continuous, safe-by-design testing directly in live production environments. While its capabilities center on autonomous execution across internal networks, external surfaces, and cloud environments, it heavily emphasizes automated pentesting, automated red teaming, and alignment with Continuous Threat Exposure Management (CTEM).

    Astra Security

    Astra Security provides one of the most direct examples of autonomous pentesting in the market today by explicitly labeling its core offering as “Autonomous Pentesting.” Designed as a hybrid PTaaS platform, Astra’s AI engines actively discover, chain, and exploit security flaws across web applications, APIs, and cloud infrastructure. By pairing this autonomous engine with human security researcher validation and direct developer integrations, Astra is clear about its focus on automated, end-to-end vulnerability execution.

    Horizon3

    Horizon3’s platform, NodeZero, stands out as a strong example of autonomous penetration testing. NodeZero operates without human intervention or software agents, executing real-world attack techniques across internal, external, cloud, identity, and web application environments directly in production. Rather than running static vulnerability scanning, the platform continuously chains exploits to prove actual attack paths, allowing security teams to fix prioritized risks and re-test fixes instantly.

    XBOW

    XBOW provides a compelling example of full attack chain automation by operating as an entirely autonomous AI hacker. Rather than running simple scans or delivering theoretical severity scores, XBOW’s AI agents explore applications and APIs to discover, chain, and exploit complex vulnerabilities. The platform validates exploitability on its own, delivering verified, reproducible proof-of-concept exploits that demonstrate exactly how an attacker could compromise a target, making it a natural fit for the autonomous testing category.

    Synack / NetSPI

    Historically, NetSPI was an exception to full autonomy, maintaining that AI should supercharge human pentesters rather than replace them. However, its merger with Synack shifts that narrative. Synack brings Sara, an autonomous AI pentester capable of handling reconnaissance, vulnerability discovery, attack path analysis, and controlled exploitation, and pairs it with the vetted Synack Red Team (SRT) for expert validation. By combining NetSPI’s extensive PTaaS capabilities with Synack’s agentic AI technology and global researcher network, the unified company bridges the gap between autonomous execution and human oversight.



    Unraveling The Terminology from Autonomous Penetration Testing Companies

    The companies above show how quickly autonomous penetration testing has moved from a niche capability to a broader market narrative. Some vendors now run full attack chains independently. Others deliver valuable AI-driven validation, exposure management, or breach-and-attack simulation that sits close to the category without fully replacing a penetration test. That overlap is where the terminology starts to get messy.

    That complexity is more than a messaging problem. A year ago, terms like “autonomous,” “automated,” “agentic,” “AI pentesting,” “exposure validation,” and “adversarial exposure validation” described more distinct capabilities.

    Today, competitive pressure has pushed vendors in adjacent categories to layer AI agents into existing platforms and borrow language from autonomous pentesting. That mix puts more responsibility on buyers to ask whether a platform independently executes a complete attack chain from initial access to impact, or does it validate exposures that a human-led process has already identified?

    What Does Autonomous Penetration Do?

    Strip away the branding and autonomous penetration testing describes a specific capability: a platform that runs reconnaissance, identifies exploitable weaknesses, chains them together, and moves laterally through an environment on its own, the way a human pentester would, but continuously and at scale. The output is proof that a specific path from an exposed asset to a business-critical system actually works, because the platform walked that path itself.

    The strongest platforms in this space also build in control. That means testing within an authorized scope, respecting intensity and severity thresholds tied to your SLAs, requiring explicit approval before privilege escalation or lateral movement, and giving your team a kill switch at every stage. Autonomy without those guardrails is a liability. Autonomy with them is what makes continuous, production-safe testing possible in the first place.

    The Real Dividing Line

    The terminology around this category will likely stay messy for a while longer, because every vendor in offensive security has a reason to want a share of the fastest-growing story in the space. But the dividing line that matters is whether a platform proves an attack path is exploitable by executing it, or tells you an exposure exists and leaves the proving to someone else. Ask that question first, and the rest of the competitive landscape sorts itself out.

    How to Evaluate Autonomous Penetration Testing Companies

    The defining question about autonomous penetration testing is whether the platform can safely execute a realistic attack path, adapt as conditions change, and prove which risks are truly exploitable. That is why buyers should evaluate each vendor by execution depth, environmental coverage, production-safe controls, and the role of human validation rather than relying on category labels alone.

    Three signals consistently separate genuine autonomous penetration testing from adjacent categories, and they are the same three that sorted the lists above.

    1. Full attack chain execution: The platform performs reconnaissance, exploitation, and lateral movement itself, rather than validating a single exposure in isolation.
    2. Freedom from predefined playbooks: The platform adapts its approach based on what it finds in your environment, similar to how a senior pentester improvises mid-engagement, rather than running a fixed script.
    3. Coverage depth: Genuine autonomous pentesting spans internal and external, network and web environments, rather than focusing on one attack surface.

    Vendors that clear all three represent a strong delivery of autonomous pentesting capability.

    For teams that want autonomous testing grounded in real-world pentest expertise, Breach360 brings agentic AI, verified exploit chaining, and human oversight together in one autonomous penetration testing solution. Book a demo of Breach360 to see how autonomous penetration testing can help your team validate attack paths continuously and prioritize the risks that matter most.

    Frequently Asked Questions about Autonomous Penetration Testing Companies

    What is the difference between autonomous penetration testing and automated vulnerability scanning?

    Autonomous penetration testing executes a full attack chain, including reconnaissance, exploitation, and lateral movement, to prove an attack path works. Automated vulnerability scanning identifies potential weaknesses without confirming whether they can actually be exploited or chained into a real-world attack path.

    Is autonomous penetration testing the same as adversarial exposure validation (AEV)?

    Adversarial Exposure Validation (AEV) is a distinct market category rather than a single product, whereas autonomous penetration testing is a specific execution capability. Over recent years, Gartner has consolidated several overlapping security assessment categories into the broader umbrella of AEV.

    While AEV confirms whether a specific exposure is exploitable as part of continuous exposure management, autonomous penetration testing independently executes the entire attack chain from initial access through impact. This distinction is why certain cybersecurity vendors provide AEV capabilities without offering full autonomous pentesting.

    Which companies offer true autonomous penetration testing in 2026?

    Six vendors currently run autonomous penetration testing as a standalone product that executes a full attack chain without a predefined playbook: BreachLock, Pentera, Astra Security, Horizon3.ai, XBOW, and Synack.

    Why are so many cybersecurity vendors using the word “autonomous” right now?

    Autonomous penetration testing has become one of the fastest-growing categories in offensive security, and vendors in adjacent categories, including breach and attack simulation and exposure management, have added agentic AI features to stay relevant to that conversation. This has made the terminology less precise, even where the underlying products remain genuinely different.

    Does autonomous penetration testing replace human pentesters?

    Not at the vendors doing this well. The strongest platforms combine autonomous execution with human oversight, including approval gates before privilege escalation, a kill switch, defined scope and severity thresholds, and in some cases review by certified human pentesters. Autonomy handles scale and continuity. Human expertise handles judgment calls the platform is not built to make alone.

    – Read the full story from BreachLock


    Disclaimer: All competitor capabilities referenced in this article are based on publicly available information and may not reflect the vendor’s full or current feature set.


    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post 6 of the Best Autonomous Penetration Testing Companies in 2026 appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites. The vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of […]

    The post Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶