RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
Chris Thompson made a career breaking into banks, nuclear power plants, and defense contractors—and getting paid to do it. Now, he recognizes that red team penetration testing is evolving dramatically. This premise is the basis of RemoteThreat, an integrated offensive cyber operations platform he and Shawn Jones, co-founder and CTO, founded in 2025. The platform aims to help organizations stay ahead of attackers who are picking up the pace, largely due to artificial intelligence (AI). Rather than replacing humans, the platform uses AI to assist teams during mission objectives while testing how their defenses will hold up against a variety of threats. 🚀
Frontier AI models are advancing so rapidly that traditional penetration testing won’t exist in two years as it stands today, explains Thompson, RemoteThreat CEO and co-founder. Traditionally, a few senior testers manage teams who conduct one- to three-week assessments, but that model is breaking down. Organizations won’t pay for three-week engagements anymore, and Thompson predicts the same change will soon hit even high-end red teaming work, as economic pressures increase. “Pen testing is going to be a commodity market; it’s going to be done at scale,” Thompson tells Dark Reading. He urges, “Let’s prepare these companies for when models advance a year from now and they [adversaries] start to be a lot stealthier. Let’s give them the platform to test against that.”
An important piece of that involves unique tooling. Real nation-state actors don’t use the same tools twice. They don’t rely on static payloads that security tools can signature and block. They’re highly adaptable, and simulations must match that. RemoteThreat works to prepare organizations by building tools from scratch every time. Thompson says the tooling can bypass Tier 1 endpoint detection and response (EDR) providers and security controls. Attackers, particularly ransomware threat actors, have become increasingly skilled at bypassing EDR. “When you’re up against a skilled actor, you’re going to be up against the frontier models in a year from now that can build more exquisite tooling,” he says. He warns that organizations can’t overly rely on EDR providers to be the only control preventing someone from getting on a bank’s foreign exchange platform, stealing healthcare data, or breaking into a nuclear controlled network, for example.
While developing the platform, the founders focused on a series of questions that addressed what happens if an attacker does get in a victim environment, pushing teams to challenge assumptions on how well their networks are actually protected. This includes:
- What happens when attackers bypass an organization’s EDR?
- How do they simulate an adversary going after critical objectives once they’re inside?
- How do they prove whether compensating controls will stop them?
- And perhaps most importantly, how do organizations design defenses that force attackers to make enough noise to get caught?
The platform doesn’t look to automate all processes; it’s about moving faster and at a scale that was previously unachievable. Organizations are allowed to use their own AI models, but they don’t need AI. They can use the platform as a human red team operator, or a hybrid version with some AI assistance. There is a huge push on internal teams to test more and to test faster at a higher degree of sophistication.