Autonomous Pentesting and CTEM for Federal Cyber Defense | AFCEA Panel

Which vulnerabilities can an attacker exploit in your agency today? An AFCEA SIGNAL panel on autonomous pentesting, CTEM and federal cyber defense. Vulnerability programs produce thousands of findings, but not every finding is a real risk. In this AFCEA SIGNAL Media webinar, "Find, Fix, Verify: Bringing the Attacker's Perspective to Federal Cyber Defense" (recorded October 21, 2026), a CISA vulnerability management leader, the CEO of the Center for Internet Security, a former DHS CISO and a SANS Institute instructor discuss how to find exploitable attack paths, rank fixes by mission risk and validate security controls. They also cover what AI really changes, BOD 26-04, zero trust and how to measure resilience. In this session: Why traditional vulnerability management falls short: unknown assets, shadow IT and findings that are not real risk What is real and what is hype about AI in cyber, from faster attack path discovery to AI that repairs flaws How autonomous pentesting chains medium and low findings into critical attack paths How BOD 26-04 frames exposure: internet-facing assets, KEV and critical CVEs, automated exploitation and level of control How CTEM fits with zero trust, since both reject unverified assumptions How to measure resilience by outcomes, not activity, including time to patch Key questions answered: What is the biggest limitation of traditional vulnerability management? You can only scan the assets you know about, so shadow IT and dangling DNS records slip through. And not every finding equals a risk, so closing more tickets does not always mean less risk. How does autonomous pentesting find exposures traditional tools miss? Manual testers have limited time, so medium and low findings often get pushed aside. Autonomous testing can check them at scale and show when several chain into a critical attack path. What does BOD 26-04 ask federal agencies to check? As summarized on the panel, four questions: which assets are exposed to the internet, whether they carry KEV or critical CVEs, whether exploitation can be automated, and whether an attacker would gain partial or full control. How does CTEM fit with zero trust? Both reject unverified assumptions. Zero trust keeps checking whether a user or app needs access, and exposure management keeps checking whether vulnerabilities and controls create a viable path to mission impact. How do you measure cyber resilience? Measure outcomes, not activity: does an adversary still have a viable path to the mission? Time to patch is another gauge. If you know your internet-facing inventory, you can patch fast when a new flaw drops. What is the first step to implementing CTEM? Pick a tool set that fits your team, commercial or open source, and set up governance for who acts on the results. Then tie the program to the executives who fund it. Panelists: John Gilligan, President and CEO, Center for Internet Security Kenneth (Ken) Bible, former CISO, U.S. Department of Homeland Security David Meyer, CIO, Novig, and SANS Institute instructor Sam Vasquez, Chief of Operations for Vulnerability Management, CISA Moderator: Nari Taylor, Editor in Chief, SIGNAL Media Chapters: 0:00 Welcome and panel introductions 1:30 Limits of traditional vulnerability management 4:00 AI in cybersecurity: what is real and what is hype 8:00 Are federal agencies approaching AI risk the right way? 11:45 Small agencies, local government and critical infrastructure 19:00 What vulnerability reports miss: the attacker's view 22:30 BOD 26-04 and a risk-based approach 24:30 Open source software and SBOMs 27:15 How autonomous pentesting finds what other tools miss 29:45 On-prem vs. cloud trade-offs 31:30 Prioritizing findings by mission risk and criticality 42:15 CTEM and zero trust 48:00 Measuring resilience: outcomes, not activity 54:15 Audience Q&A: small budgets and first steps to CTEM 58:30 Closing advice: know what you own, what is exposed, what can be exploited Picus Security was a sponsor of this AFCEA SIGNAL Media webinar. Bringing CTEM and autonomous pentesting together is our focus. Learn more about Picus Security: https://www.picussecurity.com/ Panelists' views are their own and do not imply endorsement of Picus Security or any other vendor. #CTEM #AutonomousPentesting #FederalCybersecurity #VulnerabilityManagement #ZeroTrust