The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
115 posts
External assets stay the most attacked entry point into any organization. What external testing looks like in 2026, and how we approach the engagement.
Read the post →The 2025 edition of the OWASP Top Ten is out. What moved, what is new, what it says about where web application risk is actually concentrating now.
Read the post →One in three phishing attempts now happens outside email, and LinkedIn is where your staff are easiest to reach. What that changes about your defenses.
Read the post →A critical SharePoint flaw let attackers run code with no password at all. What the breach revealed about relying on vendor patches and nothing else.
Read the post →Testing is moving from annual audit to continuous validation, and AI is accelerating both attack and defense. What that shift means for security leaders.
Read the post →APIs carry the traffic and often none of the scrutiny. The vulnerabilities that recur, and the authentication, validation, and rate limiting that stop them.
Read the post →An annual test is a snapshot of an environment that changes daily. What continuous penetration testing involves, and how to judge whether you need it.
Read the post →A penetration test asks what is vulnerable. A red team asks whether a determined adversary gets caught. Which question you are ready to have answered.
Read the post →What a network penetration test involves, stage by stage: scoping, enumeration, exploitation, privilege escalation, and the lateral movement that follows.
Read the post →SQL injection, XSS, broken authentication, IDOR, misconfiguration, and CSRF. The six that cause most breaches, what each looks like, and how to prevent them.
Read the post →