Technical notes from the people who run pentests and operate digital risk every day — no fluff, no content dressed up as a sales pitch.
When an agent gains tools and credentials, the conversation becomes a control plane. Learn how to limit permissions, validate inputs and outputs, and test a POC before production.
Read article →A list of CVEs with CVSS scores pasted from a scanner isn't a pentest report, it's a nice-looking PDF. Three things separate one from the other: reproducible evidence, severity adjusted to your environment, and remediation a developer can actually apply. How to spot each before you sign.
Read article →One HTTP request with no credentials at all turns into administrator access. And a Metabase administrator does not just see reports: they see the connection credentials for every database wired into the tool.
Read article →The breach is arguable. The date you learned about it and the date you reported it are not. That is why failure to notify is the cheapest violation to prove.
Read article →The service was bound to 127.0.0.1, with no port open to the internet, and an ordinary website still managed to send it a command. The security check that failed fit on a single line of code.
Read article →What grew fastest was not the attack, it was the phase that comes before it. How an attacker builds a target list without sending a single packet to your server.
Read article →A path traversal in the vCenter syslog server turns into unauthenticated code execution, and from there the attacker reaches the entire ESXi fleet. Five days was the gap between the patch and mass exploitation.
Read article →Lazarus used a fake job offer on LinkedIn to get in, and a Windows kernel zero-day to erase its own tracks before any EDR noticed. A real-world case for why local privilege escalation matters as much as remote RCE.
Read article →For study purposes: how CIH, WinNuke, Ping of Death, and other historical Windows 95 flaws worked under the hood, and why the same failure pattern still shows up in modern systems.
Read article →An unauthenticated RCE in TeamCity On-Premises, CVSS 9.8 and already under confirmed active exploitation per CISA, shows why a CI/CD server deserves the same pentest scope as a production system.
Read article →The same five failure patterns keep showing up API after API. A practical rundown of what to test before someone outside finds it first.
Read article →The moment an AI agent gets access to a tool, a file, or a shell, prompt injection stops being a chatbot trick and becomes a path to command execution. A technical overview with one confirmed real-world case.
Read article →Tell us what you need to validate and the team scopes a penetration test to match.
Ready to assess your company's risk?