Hex Security is now Parameter // We're at Black Hat USA 2026
[ Blog ]
On autonomous security testing, AI agents, and shipping safely.
How Sentinel, our agentic PR review bot, catches exploitable security bugs before they merge by following execution paths across a pull request, not just scanning the diff.
In three weeks our agents ran 2,300 autonomous AI penetration tests. ~37% of findings were high or critical, mostly authorization, IDOR, and business-logic bugs scanners miss.
Hex Security has a new name and a new home. The company behind it, Anytool, Inc., is unchanged, and so is the product. Here is what changed, what didn't, and where to verify it, including in person at Black Hat USA 2026.
Fix the model to Claude Opus 4.8, keep the paper's protocol, change only the harness, and the scaffold lifts Tier-2 from 31/140 (22.1%) to 39/140 (27.9%).
The annual pentest was built for a world that shipped software twice a year. Here's what continuous penetration testing means, where the market's definitions fall apart, and how to tell real coverage from a scanner in a trench coat.
Server-side request forgery turns an innocent 'fetch this URL' feature into a path straight to your cloud's metadata endpoint, and the temporary credentials behind it. Here's the full chain and how to break it.
Security can't be the team that says no once a quarter. It has to move at the cadence engineering already runs at: every commit, every deploy.
© 2026 Anytool, Inc.
