Blog
Field notes from the offensive side
Practical writing on penetration testing, attack techniques,
and the compliance frameworks that reference them.
AWS Penetration Testing: Scope, Rules, and What Gets Tested
How AWS penetration testing works: the shared responsibility model, what you may test without permission, IAM and S3 attack paths, and how to scope an engagement.
Read the articleAWS Penetration Testing: Rules, Scope, and What to Test
How AWS penetration testing works: what Amazon allows without approval, what's off-limits, the misconfigurations that cause real cloud breaches, and how to scope a test.
Black Box vs White Box vs Grey Box Penetration Testing
What black box, white box, and grey box penetration testing each mean, what each finds and misses, what they cost, and how to choose the right method for your goal.
BloodHound: Mapping Active Directory Attack Paths
What BloodHound is, how it maps hidden Active Directory attack paths to Domain Admin, what its findings reveal about your AD, and how defenders use it to close them.
Which Compliance Frameworks Require Penetration Testing?
A framework-by-framework guide to penetration testing for compliance: what SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR and NYDFS actually require, and how often.
E-Commerce & Retail Penetration Testing
Penetration testing for e-commerce and retail: PCI DSS obligations, the checkout and payment risks that matter, Magecart and API threats, and how to scope a test.
Evil-WinRM: Windows Remote Management for Testers
What Evil-WinRM is, how testers use it to get an interactive shell over WinRM, what its use in a report reveals about your controls, and how defenders detect it.
Evilginx: Phishing That Bypasses MFA
What Evilginx is, how adversary-in-the-middle phishing steals session tokens to bypass MFA, what it means for your defences, and how phishing-resistant MFA stops it.
Fintech & Financial Services Penetration Testing
Penetration testing for fintech and financial services: the regulations that require it, what to scope across APIs, apps and cloud, and how to test payment flows safely.
Gobuster: Directory, DNS and Vhost Brute-Forcing
What Gobuster is, how testers use it to discover hidden directories, subdomains and virtual hosts, what its findings mean for your attack surface, and how to detect it.
Healthcare Penetration Testing: A Complete Guide
Healthcare penetration testing explained: what HIPAA expects, ePHI scoping, EHR and medical device testing, and how to run an assessment without disrupting care.
How to Choose a Penetration Testing Company
What separates good penetration testing companies from bad ones: certifications, methodology, reporting, retesting, and the questions to ask before you sign.
Impacket: The Windows Network Attack Toolkit
What Impacket is, the key scripts testers use against Active Directory, what its findings reveal about your Windows network, and how defenders detect and stop it.
ISO 27001 Penetration Testing Requirements
Does ISO 27001 require penetration testing? What Annex A 8.8 and Clause 9 actually demand, how testing provides the evidence, scope, frequency, and what auditors expect.
Kerbrute: Active Directory User Enumeration Explained
What Kerbrute is, how testers use it to enumerate Active Directory users and spray passwords quietly, what its findings mean, and how defenders detect and stop it.
Penetration Testing for Law Firms
Why law firms are high-value targets, what client-confidentiality and ethics rules demand, what to scope, and how penetration testing protects privileged data.
Masscan: Internet-Scale Port Scanning Explained
What Masscan is, how it scans enormous IP ranges in minutes, how it differs from Nmap, what its findings mean for your external attack surface, and how to detect it.
msfvenom: Payload Generation Explained
What msfvenom is, how testers use it to generate and encode payloads, what its use in a report means, and how modern defences detect and stop generated payloads.
NetExec (nxc): The CrackMapExec Successor Explained
What NetExec is, why it replaced CrackMapExec, the protocols and modules that matter in a real engagement, and how defenders detect it.
How to Choose a Penetration Testing Company in NYC
A buyer's guide to choosing a penetration testing company in New York: what local presence actually buys you, the NYC-specific compliance angles, and how to compare firms.
OWASP ASVS: The Application Security Verification Standard
What the OWASP Application Security Verification Standard (ASVS) is, how its three levels work, how it differs from the Top 10, and how to use it in a pentest.
Penetration Testing as a Service (PTaaS): What It Is
What PTaaS actually means, how it differs from traditional penetration testing and automated scanning, what it costs, and when a subscription model is worth it.
Responder: LLMNR/NBT-NS Poisoning Explained
What Responder is, how it poisons LLMNR and NBT-NS to capture Windows credentials, what a finding means for your network, and how to shut the attack down.
Smishing: SMS Phishing Attacks and How to Defend
What smishing is, why SMS phishing bypasses email defences and works so well on phones, the common attack types, and how to test and defend against it.
Spear Phishing: Targeted Attacks and How to Defend
What spear phishing is, how it differs from ordinary phishing, the real techniques attackers use against named employees, and how testing and controls stop it.
Vishing: Voice Phishing Attacks and How to Defend
What vishing is, how attackers use phone calls and AI voice cloning to bypass technical defences, the real-world attacks that start with a call, and how to defend.
Vulnerability Assessment and Penetration Testing (VAPT)
What VAPT means, how vulnerability assessment differs from penetration testing, when you need each, what a combined engagement covers, and what it costs.
Offense in Depth in Red Team Operations
Defense in depth layers protection. Offense in depth layers attack paths so a red team still reaches its objective when one route fails. Here is how it works.
Security Between Penetration Tests
An annual pentest covers two weeks and leaves fifty uncovered. Here is how to secure the rest of the year without waiting for the next scheduled engagement.
The Limits of AI in Penetration Testing
AI is changing penetration testing, but it will not replace human testers. Here is what it does well, where it falls short, and why judgment still wins.
The Cost Savings of Proactive Security
Proactive security looks like pure cost until you price the breach it prevents. Here is the economic case for testing early, in terms a CFO will recognize.
Penetration Testing for AI and LLM Systems
AI applications add attack surface that traditional testing misses. See how attackers target LLMs, from prompt injection to data leakage, and how to test them.
Indirect Prompt Injection Explained
Indirect prompt injection hides attacker instructions in content an AI later reads. Learn how the attack works, why it is dangerous, and how to defend.
Is Your Organization Ready for Red Teaming?
Red teaming rewards mature security programs and overwhelms immature ones. Here is how to tell if you are ready, and how to plan a scenario worth running.
Ransomware: How Modern Attacks Actually Work
Ransomware is no longer just encryption. Here is how modern attacks unfold, why backups are not enough, and where penetration testing breaks the kill chain.
Planning for AI Vendor Failure
AI startups fold, get acquired, and pivot constantly. If your product depends on one, here is how to stay resilient when your AI provider disappears or changes.
Application Security Myths, Debunked
Common myths quietly undermine application security programs. Here are the most persistent ones, and what actually holds up once you test them against reality.
The OWASP API Security Top 10, Explained
The OWASP API Security Top 10 names the risks that break real APIs. Here is what each category means in plain terms, and why authorization dominates the list.
API Security Best Practices
A practical guide to API security: authentication, authorization, rate limiting, input validation, and the design habits that keep your endpoints from leaking.
Penetration Testing Cost in 2026
What drives penetration testing cost: scope, test type, and timeline, plus realistic price ranges by engagement.
How to Prepare for a Red Team Engagement
Is your organization ready for a red team? Signs of readiness, how objectives and scenarios are set, and what to expect from kickoff through the final readout.
Crafting Realistic Red Team Scenarios
A red team is only as valuable as its scenario. Learn how to design intelligence-driven, realistic scenarios modeled on the threats that actually target you.
Getting the Most From a Red Team
The value of a red team is in what you do after it. Here is how to turn an exercise into lasting improvement through debriefs and real follow-through.
How Integrations Expand the LLM Attack Surface
An LLM becomes far more dangerous the moment you connect it to tools and data. Here is how integrations expand the attack surface, and how to contain the risk.
SOC 2 Pentest Requirements Explained
Does SOC 2 require a penetration test? What auditors expect, what the report should include, and when to time testing.
The OWASP Top 10 for LLM Applications, Explained
A plain-English guide to the OWASP Top 10 for LLM Applications: what each risk means, why it matters, and how to test your AI system against it.
SaaS Penetration Testing: A Complete Guide
SaaS penetration testing explained: multi-tenant isolation, API and auth testing, what enterprise buyers and SOC 2 auditors expect, and how to scope an engagement.
Cloud Application Security: A Practical Guide
A practical guide to cloud application security: the shared responsibility model, the risks that actually cause cloud breaches, and how to test for them.
Shifting Security Left in the SDLC
Shift-left security moves testing earlier in the development lifecycle, where flaws are cheap to fix. Here is what it means in practice and how to do it well.
Adversarial Machine Learning: Key Terms
A plain-English glossary of adversarial machine learning: evasion, poisoning, model inversion, extraction, and the other terms security teams need to know.
Defensive vs Offensive Security: The Difference
Defensive vs offensive security explained: what each approach does, how blue teams and red teams differ, and why you need both to actually stay secure.
CTEM: Continuous Threat Exposure Management
CTEM is a framework for continuously finding and reducing exposure instead of testing once a year. Here is what its five stages mean and how to put it to work.
The Ultimate Penetration Testing Checklist
A practical penetration testing checklist covering scoping, pre-engagement, testing coverage, reporting, and remediation, so your next pentest is thorough and audit-ready.
Red Team vs Blue Team: The Difference
Red team vs blue team explained: what each does in cyber security, how they differ, where purple teaming fits, and how red teaming compares to penetration testing.
External Attack Surface Management (EASM), Explained
What external attack surface management (EASM) is, why your internet-facing footprint keeps growing, and how it works alongside penetration testing.
Building a Secure Code Review Program
Secure code review finds flaws automated scanning misses, at the source. Here is how to build a program that scales without slowing your engineers down.
PCI DSS Compliance Checklist
A practical PCI DSS compliance checklist covering all 12 requirements, scoping your cardholder data environment, and the penetration testing PCI requires.
A Layered Approach to AppSec Testing
No single test secures an application. Learn how SAST, DAST, pentesting, and code review fit together into a layered application security testing strategy.
How to Scope Your First Penetration Test
A step-by-step guide to scoping your first penetration test: what to define, what to expect on a scoping call, and mistakes to avoid.
Security Risk Assessment: A Practical Guide
What a security risk assessment is, how it differs from a penetration test, the steps involved, and how it fits compliance frameworks like SOC 2, ISO 27001, and HIPAA.
IT Security Audit: What It Is and How It Works
What an IT security audit is, what it covers, how it differs from a penetration test, and how information security audit services support SOC 2, ISO 27001, and HIPAA.
Types of Penetration Testing: A Complete Guide
The main types of penetration testing by target (web, API, mobile, network, cloud, hardware, social) and by method (black, white, and grey box), and how to choose.
Balancing LLM Security and Usability
Lock an AI assistant down too hard and it becomes useless; too loose and it becomes a liability. Here is how to find the balance between security and usability.
Cloud Security Best Practices
The cloud security best practices that actually prevent breaches: identity, data protection, configuration, monitoring, and testing, in priority order.
Proactive Security: Finding Risk First
Reactive security waits for the alarm. Proactive security finds and fixes weaknesses before attackers reach them. Here is what the shift looks like in practice.
Automated vs Manual Penetration Testing
Automated penetration testing is fast and cheap, but it misses the flaws that cause breaches. Here is what automation catches, what it cannot, and the right blend.
Web Application Security Testing: The Complete Guide
The types of web application security testing (SAST, DAST, IAST, SCA, and manual penetration testing), what each catches, and how to combine them effectively.
API Penetration Testing: A Complete Guide
What API penetration testing covers, which vulnerabilities matter most, and how to scope a test for REST, GraphQL, and internal APIs before attackers strike.
NYDFS 23 NYCRR 500: What Penetration Testing Does the Regulation Actually Require?
A practical guide to the penetration testing and vulnerability assessment requirements in New York's NYDFS Cybersecurity Regulation (23 NYCRR 500) for covered financial entities.
The OWASP Mobile Top 10, Explained
A plain-English guide to the OWASP Mobile Top 10: the most critical mobile app security risks for iOS and Android, and how to test your app against them.
The Risk of Malicious Connected Apps
OAuth connected apps can read your email and files without ever touching your password. Here is how malicious integrations work and how to limit the damage.
Penetration Testing vs Vulnerability Scanning
Penetration testing vs vulnerability scanning vs vulnerability assessment: what each one is, how they differ, and when you need which. A clear, practical comparison.
Application Security Program Maturity
How mature is your application security program? A practical checklist across five levels, from ad hoc to optimized, and how to move up to the next one.
The Security Risks of Vibe Coding
AI can generate working code from a prompt in seconds. It can generate insecure code just as fast. Here are the risks of vibe coding and how to ship it safely.
Getting Started with Application Security
Building an application security program from nothing is less about tools than sequence. Here is a practical first-90-days path that avoids the common traps.
Put it into practice
Reading is good. Testing is better.
Tell us what to test and see your fixed price.
Prefer the full scoping questionnaire?Get a Fixed-Scope Quote
Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.