The Hacker Who Put the Annual Pentest on a Permanent Shift

The first things Casey Cammilleri took apart were toys. He wanted to see what lived beneath the plastic, how the pieces spoke to one another, and why a thing behaved as it did. It is a charming childhood habit until the toys become corporate networks. Then people call it penetration testing and, crucially, ask that you send an invoice.

Cammilleri made a career of sanctioned trespass. He moved from internet support at TDS to network security at Trustwave, then into security research at 403 Labs and consulting at SynerComm. Each role put him closer to the adversary's point of view. A network might look orderly from the conference room and quite hospitable from an exposed server. His job was to find the difference.

Years of testing revealed a flaw bigger than any single client vulnerability. Businesses changed every day. Their security assessments arrived once a year. A report could be accurate on Monday and historical fiction by Friday, after a cloud service appeared, an acquisition connected a new domain, or a developer opened a port in the innocent pursuit of making something work.

A calendar is a poor security device

The traditional engagement had a ritual elegance: scope the work, perform the test, deliver the PDF, close the project. It also had a comic weakness. Attackers were under no obligation to respect the appointment. Cammilleri's answer was to change penetration testing from an event into a condition, continuously watching the attack surface and testing as systems or threats changed.

In 2017, that idea became Sprocket Security. The earliest version was not a grand machine. It was Cammilleri, a code editor, the reputation he had built as a tester, and about $40,000 in cash. Local relationships mattered. Early customers knew his work from years of consulting around Wisconsin, which made trust transferable when he became a founder.

“Technology is constantly evolving and so must security measures.”Casey Cammilleri

He had hit the classic expert's ceiling: one person can perform only so many careful engagements. His escape route was software. Sprocket's platform would automate the repeatable work, watch many environments at once, and reserve human attention for context, exploitation and judgment. The business began as a method for stretching expertise without pretending expertise was mechanical.

Every old job left a useful tool on the bench

Cammilleri studied network security at Madison Area Technical College, now Madison College, from 2004 to 2007. His first listed technology job, at TDS, included leading a custom firmware project for DSL modems. The project reportedly cut help-desk calls by an average of 3,000 a month. It was an early lesson in leverage: fix the system once and spare people thousands of repetitive conversations.

At Trustwave, he advanced from analyst to senior network security engineer. A former colleague remembered him writing scripts that improved an entire offering instead of patching one customer's problem. At 403 Labs he conducted network, web application and application tests. At SynerComm he climbed from information-assurance consultant to senior consultant. By the time Sprocket arrived, the founder had already spent a decade watching tools, processes and organizations fail under pressure.

His early Sprocket blog posts show the builder still close to the keyboard. In 2018 he wrote about MITRE CALDERA, launching temporary red-team infrastructure in AWS with Terraform, and assembling remote pentesting dropboxes. These were not philosophical essays wearing tactical costumes. They were instructions for removing friction from work he actually did.

Bootstrapping is mostly administration in work clothes

Sprocket stayed bootstrapped for five years. Cammilleri has been refreshingly plain about what building a company demanded: bookkeeping, hiring, operations and leadership were not optional side quests. Technical ability did not grant immunity from payroll. He learned some tasks, performed them badly at first by his own account, improved, and hired help where attention was better spent elsewhere.

One choice gives the operating philosophy away. He hired bookkeeping and marketing help before building a sales team. Customer conversations remained with the founder, while specialized work that consumed his time moved to people suited for it. He has also explained why a small pitch prize did not always tempt him: the same hours might win a customer and the revenue that came with one.

In March 2024, Sprocket announced an $8 million Series A led by Blueprint Equity, with Capital Midwest Fund participating. The money was earmarked for the platform, customer success, sales and marketing. It arrived after a product thesis, paying customers and years of operational scar tissue. Capital was an accelerant, not a substitute for combustion.

The company also remained conspicuously Madisonian. Cammilleri has organized MadSec, the local information-security group, turning community meetings into a place to learn, meet peers and find talent. He recruits from Madison College because its graduates arrive with practical experience. Sprocket chose StartingBlock as its home because he wanted an office that felt energetic and collaborative. He later credited that ecosystem while describing growth from nine employees to 43.

The machines arrived, supervised

Sprocket's recent development looks like a return to the original scaling question with sharper tools. In June 2026 it launched Apex, an AI agent for unauthenticated web applications. Apex maps an application, forms hypotheses, attempts exploitation and writes an account of each run. It uses a customer's assets and testing history as context, then sends suspected findings to human testers for validation before publication.

A month later, the company described a telling result. Apex found a session-injection flaw within minutes; a human tester used that foothold to uncover a larger attack path. Together the agent and tester found two previously unknown vulnerabilities. The division of labor was clean. The machine read broadly and quickly. The person noticed what a stray response might mean and kept pulling.

Then came Link in August, built for the territory behind a login. It holds multiple credentialed roles at once and tests whether one role can reach another's data or actions. Apex approaches from outside; Link works from within. Both sit inside the continuous program and both remain supervised. Cammilleri's point is practical rather than mystical: the customer should receive findings that are proven, prioritized and ready to act on.

“Building something meaningful is rarely about being ready, just be willing to figure it out as you go.”Casey Cammilleri

That sentence works as a founder's confession and a pentester's method. You begin without a complete map. You probe. You update your model. You find the door that was not supposed to open. The useful difference in business is that sometimes the vulnerable system is your hiring process, your calendar, or your own reluctance to hand over a task.

A finding is only interesting until somebody fixes it

Security companies can drown customers in proof of activity: assets scanned, alerts raised, pages delivered. Sprocket's model points toward a sterner measure. Did the client understand the exploitable risk? Did it get fixed? Did someone verify the repair? Continuous testing becomes valuable when it shortens the distance between discovery and remediation, not when it merely supplies more colorful evidence of danger.

Cammilleri's public work keeps returning to that preference for useful outcomes. The podcast he launched in 2024, Ahead of the Breach, invites practitioners and security leaders to explain what works in the field. The company's attack-surface tool was released publicly at no cost in 2025. Its 2026 awards recognized offensive security, penetration testing and exposure management, but the more revealing accomplishment is the operating system beneath them: monitor, test, explain, fix, verify, repeat.

The child taking apart toys wanted to understand the mechanism. The engineer wrote scripts so a fix could travel farther. The consultant noticed that an annual engagement could not keep pace with daily change. The founder built a company around correcting the cadence. Now the AI agents extend the number of places that curiosity can look, while people remain responsible for deciding what they found.

There is no final state in that story, which may be why it suits him. Networks change. Companies change. Founders, if they are paying attention, change too. Cammilleri's career has been an argument for making inspection continuous and certainty temporary. Nothing stays fixed merely because the report says it was secure last year.