5 min read
THE END OF THE ANNUAL PENTEST
The annual penetration test satisfied compliance and reassured boards for a decade. The numbers now say that model has been overtaken. What replaces it.
Read the post →Blog — page 3
Research and analysis
The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
116 posts
- 6 min read
What a Pentest Actually Covers And... What It Does Not
Scoping, rules of engagement, and the real difference between a penetration test, a vulnerability scan, and a red team engagement. What you are buying.
Read the post → - 4 min read
The clock is running out — and pentesting is no longer optional
Attackers used to give you a month to patch and now give you five days, while regulators remove the choice about testing. What good looks like in 2026.
Read the post → - 3 min read
DNS Reconnaissance for Defenders: Using DNSDumpster to Map Your External Attack Surface
DNSDumpster shows you the same public DNS picture an attacker starts from. How to use it to map your own external attack surface, for free, this afternoon.
Read the post → - 4 min read
The Expanding Attack Surface: Why Visibility Alone is Not Security
Dashboards enumerate assets. None of that is defense. Why discovery does not equal security, and where identity multiplies an exposure into a breach.
Read the post → - 5 min read
Security vs Compliance: Why Passing an Audit Isn’t the Same as Being Secure
Compliance verifies that controls exist. Security verifies they hold. Here is where the gap opens up, and why breached organizations were often fully certified.
Read the post → - 5 min read
When “Low Severity” Becomes High Impact: The Limits of Vulnerability Risk Management
Attackers chain low-severity findings into serious compromise. Why severity scores rank issues badly on their own, and what to prioritize instead.
Read the post → - 5 min read
CVSS v4 vs CVSS 3.1 - What’s New and Improved
CVSS v4 changes how severity is scored, and what your reports will look like. What is new, what improved, and how to read the two versions side by side.
Read the post → - 4 min read
The 5 Things to Do This Quarter to Prepare for 2026 Cyber Threats
The most damaging incidents are quiet ones built for leverage. Five things worth doing this quarter, in the order that reduces the most risk soonest.
Read the post → - 3 min read
Top External Network Penetration Testing Findings of 2025
The findings we reported most often on external network engagements in 2025, ranked, with what each one usually means about the environment behind it.
Read the post →