The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
116 posts
An internal penetration test answers the question an external one cannot: what happens once somebody is already inside. The process, and the usual findings.
Read the post →The Clorox cyberattack cost far more than remediation. Why reputational damage outlasts the incident, and where regular testing changes the outcome.
Read the post →An external penetration test covers everything an attacker can reach from the internet without credentials. What is in scope, and what the results tell you.
Read the post →Source code access changes how you test a web application. Finding targets, running semgrep, and reading code for the bugs a black box test never reaches.
Read the post →Some flaws cannot be patched because they were decisions. What insecure design means, with the Ashley Madison, Equifax, and Mirai breaches as illustrations.
Read the post →Default settings, verbose errors, and unprotected files. Security misconfiguration is vague as a category and extremely specific once somebody exploits it.
Read the post →Broken access control is the top entry in the OWASP Top Ten for a reason: it is everywhere, and it is invisible to a scanner. What testing it properly means.
Read the post →A web application firewall filters traffic before it reaches your app. What it genuinely stops, what it only delays, and why it is not a substitute for fixes.
Read the post →White box, black box, and grey box describe how much the tester knows before starting. What each approach finds, misses, and costs, and how to choose.
Read the post →Certificate pinning and root detection raise the cost of attacking a mobile app. They do not make it unhackable, and here is how testers get past both.
Read the post →