What do cyber crisis management, endpoint detection, penetration testing, and autonomous AI have in common? They all expose the same challenge: organizations need to continuously reassess how prepared they are for today’s cybersecurity threats.
Throughout September, October, and early November 2026, AMATAS experts took part in 9 events across Bulgaria and the UK, including industry conferences, technical workshops, and business forums. From real-world incident response cases to live demonstrations of emerging attack techniques, our team brought practical cybersecurity experience to discussions with business leaders, security professionals, and technology innovators.
Here’s a look at the key conversations and insights that emerged along the way.
The Future of Penetration Testing Is Already Taking Shape
How can organizations keep their security assessments relevant when their technology environments change almost daily?
This was one of the central questions explored by Marko Simeonov, CEO of AMATAS and Plainsea, at Dynamics Connect 2026 in Sofia on November 4.
In his session, “The New AI Frontier in Penetration Testing,” Marko examined how artificial intelligence is transforming the way security teams discover vulnerabilities, validate risks, and assess increasingly complex IT environments.
Traditional point-in-time penetration testing remains an important security practice. However, modern organizations continuously introduce new applications, infrastructure changes, integrations, and technologies, creating potential security gaps between assessments.
AI-powered approaches can accelerate parts of the testing process and support more frequent security validation, helping organizations identify vulnerabilities closer to the moment they emerge.
This shift toward continuous security testing was also reflected in Plainsea’s participation at International Cyber Expo 2026 in London (September 29-30) and Bulgarian Security Summit 2026 in Sofia (October 28-29).
At both events, the team showcased the Plainsea platform through live demonstrations, engaging with cybersecurity professionals and discussing the evolving role of AI in offensive security.
The key takeaway: Security testing needs to evolve alongside the systems it is designed to protect.
Autonomous AI: A New Dimension of Cybersecurity Risk
What happens when AI agents can find one another, divide tasks, and coordinate a cyberattack without a central command?
This was the question Boris Goncharov, Chief Strategy Officer at AMATAS and Plainsea, explored across several major cybersecurity events this autumn, bringing the emerging capabilities of autonomous AI into focus through live technical demonstrations.
The demonstration illustrated how autonomous agents could coordinate different stages of an attack, raising questions about how traditional security controls can detect and respond to threats operating at machine speed.
At the center of his session, “I AM SWARM. You Are Next.”, was a coordinated attack scenario inspired by the Hugging Face incident. Boris recreated the attack concept using a decentralized swarm of AI agents capable of discovering one another, distributing responsibilities, and working toward a shared objective without an operator directing every action.
Boris brought these discussions to ISACA Day 2026 and International Cyber Expo in London on September 29, followed by the Regional Defence and Security Summit 2026 on October 21. At the latter, he also moderated the panel “Protecting Information, People and Operations,” connecting emerging cyber threats with the broader challenges of protecting critical assets and maintaining operational resilience.
At Bulgarian Security Summit 2026, the discussion took a particularly tangible form as Boris demonstrated AI agents coordinating an attack against surveillance camera systems. The topic continued at Dynamics Connect 2026 on November 4 and the Bulgarian Identity Conference on November 5, bringing the security implications of autonomous AI to different professional audiences.
The bigger question extends beyond any single attack scenario: How do organizations defend against threats that can coordinate, adapt, and operate with increasing autonomy?
As AI agents become part of business operations and critical systems, organizations need to reassess how they manage access, monitor unusual behavior, validate security controls, and respond to emerging attack techniques.
Threat Detection: Security Tools Are Only as Effective as Their Configuration
Not every cybersecurity challenge requires a new technology. Sometimes, the greatest risks come from security capabilities that organizations already have but haven’t fully optimized.
On October 21, Peter Djalaliev, Technical Lead at AMATAS, spoke at an ISACA Sofia Chapter event, exploring a critical issue in endpoint security: the detection gaps that can remain even when organizations have deployed Endpoint Detection and Response (EDR) solutions.
His session focused on the importance of EDR configuration, detection engineering, and continuous validation against real-world attack techniques.
Deploying an EDR platform is an important step toward improving security visibility. However, poorly configured detection rules, incomplete monitoring, and untested assumptions can leave organizations exposed to attacks that their existing tools may fail to identify.
Through practical examples, Peter demonstrated why security teams need to continuously evaluate and optimize their detection capabilities.
The message extended beyond endpoint protection: effective cybersecurity depends on how well security controls perform in practice, not simply on whether they have been implemented.
Incident Response Readiness: The Decisions That Matter Most
While emerging technologies dominated many of the autumn discussions, organizational preparedness remained equally important.
On September 17, at the ARS Bulgaria Business Breakfast at Hilton Sofia, AMATAS experts Martin Petrov and Miroslav Naydenov addressed two complementary aspects of cyber crisis management: preparing for an incident and responding effectively when one occurs.
The presentations explored how clear responsibilities, tested incident response plans, and timely decision-making can influence the outcome of a cyberattack.
Drawing on real-world incident response cases, the discussion highlighted common challenges, including delayed escalation, ineffective monitoring, unclear decision-making authority, and response procedures that have never been tested under realistic conditions.
One particularly important question emerged: Who has the authority to make critical business decisions when a cyberattack occurs?
Whether the decision involves shutting down systems, communicating with customers, notifying regulators, or responding to a ransomware demand, organizations need clear answers before a crisis begins.
The takeaway was straightforward: technical defenses are essential, but cyber resilience also depends on leadership preparedness, coordinated response processes, and the ability to act decisively under pressure.
Innovation: The People and Culture Behind Technological Progress
Beyond technical capabilities and emerging threats, the autumn event season also brought a different perspective on cybersecurity: the importance of creating an environment where innovation can happen.
On October 29, Boris Goncharov joined Crossroads by Start Up, Bulgaria, with his session “How to Create a Culture of Innovation.”
Drawing on his experience of challenging established practices and introducing new ideas, Boris explored the obstacles that organizations encounter when trying to turn ambitious concepts into reality.
For the cybersecurity industry, where technologies and attack techniques continue to evolve rapidly, the ability to adapt and challenge assumptions is particularly valuable. Innovation requires more than introducing new tools. It depends on people, leadership, and an organizational culture that encourages learning and continuous improvement.
Beyond the Conference Stage: Turning Cybersecurity Insights into Action
Across these events, AMATAS experts contributed to discussions spanning AI security, penetration testing, threat detection, incident response, critical infrastructure protection, and organizational innovation.
Different topics and audiences, but several common priorities emerged:
- Make security validation continuous. As IT environments evolve, organizations need to identify and address vulnerabilities before they become opportunities for attackers.
- Understand the security implications of AI. Autonomous systems introduce new risks that require organizations to rethink traditional approaches to monitoring, access control, and threat detection.
- Optimize existing defenses. Security tools must be properly configured, tested, and continuously improved to remain effective.
- Prepare for incidents before they happen. Clear responsibilities, tested response procedures, and leadership involvement can significantly influence an organization’s ability to manage a cyber crisis.
- Encourage innovation and adaptability. Cybersecurity teams need the flexibility to respond to emerging technologies, changing threats, and new business requirements.
These insights reflect the practical challenges organizations face every day and the importance of connecting technical cybersecurity capabilities with broader business resilience.
For AMATAS, participating in industry events is an opportunity to share knowledge gained through real-world cybersecurity operations, exchange perspectives with fellow professionals, and contribute to stronger security practices across the industry.
A big thank you to the organizers, speakers, partners, and everyone who joined the conversations, attended our sessions, or visited our team at the events.
The conversations don’t end when the conferences do. They continue through the work we do every day to help organizations understand their risks, strengthen their defenses, and build lasting cyber resilience.
