The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
111 posts
Compliance verifies that controls exist. Security verifies they hold. Here is where the gap opens up, and why breached organizations were often fully certified.
Read the post →Attackers chain low-severity findings into serious compromise. Why severity scores rank issues badly on their own, and what to prioritize instead.
Read the post →CVSS v4 changes how severity is scored, and what your reports will look like. What is new, what improved, and how to read the two versions side by side.
Read the post →The most damaging incidents are quiet ones built for leverage. Five things worth doing this quarter, in the order that reduces the most risk soonest.
Read the post →The findings we reported most often on external network engagements in 2025, ranked, with what each one usually means about the environment behind it.
Read the post →Data poisoning, adversarial input, prompt injection, and model extraction. The five AI threats worth modeling once AI is embedded in how the business runs.
Read the post →External assets stay the most attacked entry point into any organization. What external testing looks like in 2026, and how we approach the engagement.
Read the post →The 2025 edition of the OWASP Top Ten is out. What moved, what is new, what it says about where web application risk is actually concentrating now.
Read the post →One in three phishing attempts now happens outside email, and LinkedIn is where your staff are easiest to reach. What that changes about your defenses.
Read the post →A critical SharePoint flaw let attackers run code with no password at all. What the breach revealed about relying on vendor patches and nothing else.
Read the post →