4 min read
The clock is running out — and pentesting is no longer optional
Attackers used to give you a month to patch and now give you five days, while regulators remove the choice about testing. What good looks like in 2026.
Read the post →Blog — page 3
Research and analysis
The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
114 posts
- 3 min read
DNS Reconnaissance for Defenders: Using DNSDumpster to Map Your External Attack Surface
DNSDumpster shows you the same public DNS picture an attacker starts from. How to use it to map your own external attack surface, for free, this afternoon.
Read the post → - 4 min read
The Expanding Attack Surface: Why Visibility Alone is Not Security
Dashboards enumerate assets. None of that is defense. Why discovery does not equal security, and where identity multiplies an exposure into a breach.
Read the post → - 5 min read
Security vs Compliance: Why Passing an Audit Isn’t the Same as Being Secure
Compliance verifies that controls exist. Security verifies they hold. Here is where the gap opens up, and why breached organizations were often fully certified.
Read the post → - 5 min read
When “Low Severity” Becomes High Impact: The Limits of Vulnerability Risk Management
Attackers chain low-severity findings into serious compromise. Why severity scores rank issues badly on their own, and what to prioritize instead.
Read the post → - 5 min read
CVSS v4 vs CVSS 3.1 - What’s New and Improved
CVSS v4 changes how severity is scored, and what your reports will look like. What is new, what improved, and how to read the two versions side by side.
Read the post → - 4 min read
The 5 Things to Do This Quarter to Prepare for 2026 Cyber Threats
The most damaging incidents are quiet ones built for leverage. Five things worth doing this quarter, in the order that reduces the most risk soonest.
Read the post → - 3 min read
Top External Network Penetration Testing Findings of 2025
The findings we reported most often on external network engagements in 2025, ranked, with what each one usually means about the environment behind it.
Read the post → - 5 min read
AI Changed the Rules: The Threats You Need to Model in 2026
Data poisoning, adversarial input, prompt injection, and model extraction. The five AI threats worth modeling once AI is embedded in how the business runs.
Read the post → - 3 min read
External Penetration Testing in 2026: Why Proactive Security Matters More Than Ever
External assets stay the most attacked entry point into any organization. What external testing looks like in 2026, and how we approach the engagement.
Read the post →