The latest security treads, threat analysis, testing methodology, and more — from the people doing the work.
115 posts
The Clorox cyberattack cost far more than remediation. Why reputational damage outlasts the incident, and where regular testing changes the outcome.
Read the post →An external penetration test covers everything an attacker can reach from the internet without credentials. What is in scope, and what the results tell you.
Read the post →Source code access changes how you test a web application. Finding targets, running semgrep, and reading code for the bugs a black box test never reaches.
Read the post →Some flaws cannot be patched because they were decisions. What insecure design means, with the Ashley Madison, Equifax, and Mirai breaches as illustrations.
Read the post →Default settings, verbose errors, and unprotected files. Security misconfiguration is vague as a category and extremely specific once somebody exploits it.
Read the post →Broken access control is the top entry in the OWASP Top Ten for a reason: it is everywhere, and it is invisible to a scanner. What testing it properly means.
Read the post →A web application firewall filters traffic before it reaches your app. What it genuinely stops, what it only delays, and why it is not a substitute for fixes.
Read the post →White box, black box, and grey box describe how much the tester knows before starting. What each approach finds, misses, and costs, and how to choose.
Read the post →Certificate pinning and root detection raise the cost of attacking a mobile app. They do not make it unhackable, and here is how testers get past both.
Read the post →Change the ID in the URL and you see somebody else’s data. Why IDOR is so common, how it is exploited, and why scanners are poor at finding it.
Read the post →