The cybersecurity provider argues that fixed-scope, once-a-year testing can’t keep pace with environments that change weekly and is restructuring its flagship program around that premise
Most application security programs are still built around an annual rhythm: a testing scope agreed at the start of the year, a budget locked in, a plan filed away until the next cycle. Outpost24, the Sweden-based cyber risk management provider, argues that rhythm is increasingly out of step with how organizations actually operate. Cloud migrations, AI rollouts, acquisitions and new third-party integrations can all reshape an attack surface within weeks of a security plan being signed off, long before the next scheduled review.
On 6 July 2026, the company announced the next generation of CyberFlex, its advisory-led application security program, positioning it as a shift away from fixed-scope, point-in-time testing toward what Outpost24 calls a more continuous, risk-driven model.
The Pitch
Outpost24’s framing centers on AI as a factor cutting both ways, accelerating how fast organizations ship new digital services, and accelerating attacker activity alongside it. The company’s argument is that security teams working from a testing plan drafted months earlier are, in effect, defending a version of their environment that no longer exists.
CyberFlex combines external attack surface visibility, expert-led penetration testing, advisory support and flexible budget allocation within a single contract. The stated goal is to let teams identify exposures, validate their impact, prioritize remediation and reallocate investment as priorities shift, without renegotiating scope each time.
“Security teams are being asked to defend dynamic environments, while many AppSec programs are still planned around fixed scopes and annual cycles,” said Omri Kletter, Chief Product Officer at Outpost24. “CyberFlex is designed to close that gap… It gives organizations the visibility to understand what has changed, the expert validation to understand what matters, and the flexibility to shift investment as risk evolves.”
What Changed in This Release
According to Outpost24, the updated platform adds:
- A unified workflow connecting discovery, automated scanning, risk prioritization, expert-led testing and validation
- Continuous, AI-driven visibility across known, unknown and shadow IT assets
- Flexible budget allocation across testing, validation and advisory services
- Structured tiers aligned to different levels of security maturity and scope
- Updated reporting and dashboards intended for reporting to executives, boards and auditors
Testing and advisory work is delivered by Outpost24’s EU-based, CREST-certified penetration testers.
Customer Response
RS Group, an existing CyberFlex customer, is among those adopting the updated capabilities. Rebecca Wensley, the company’s Head of Security Operations, offered a customer endorsement: “CyberFlex has made it much easier to connect testing activity to real business risk. We get clearer visibility into our attack surface, expert validation where it matters most, and a more practical way to prioritize remediation and demonstrate measurable security progress to stakeholders.”
Whether continuous, adaptive testing genuinely outperforms structured annual cycles at scale, or simply shifts cost and complexity elsewhere, is likely to be tested as more organizations put programs like CyberFlex into practice over the coming year.
About Outpost24
Outpost24 is a global provider of cybersecurity solutions spanning two divisions: Outpost24, focused on Exposure Management, and Specops, its Identity and Access Management division. Founded in 2001 and headquartered in Sweden, the company operates from 14 offices worldwide, including the US, UK, France, Belgium, Spain and Israel.
