What we learn running thousands of automated pentests every week — written by the engineers and researchers who do the work. No marketing voice. No sponsored takes.
Annual penetration tests create a 364-day blind spot. This post maps exactly where that gap appears in ISO 27001, DORA and NIS2 audit evidence requirements, and why continuous AI testing closes it without replacing your human red team. Citation-ready data from 200+ enterprise security reviews in 2026.
CVE-2026-106931 affects EG Secure Solutions SiteGuard Server Edition and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being exploited in the wild, rated HIGH (CVSS 8.5). Here is what it is, who is affected, and the response. No exploit details.
CVE-2026-110447 affects Collabora Collabora Online – Built-in CODE Server and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being exploited in the wild, rated CRITICAL (CVSS 9.8). Here is what it is, who is affected, and the response. No exploit details.
CVE-2026-114625 affects Arista VeloCloud Orchestrator and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being exploited in the wild, rated CRITICAL (CVSS 9.9). Here is what it is, who is affected, and the response. No exploit details.
A reliable SOME/IP endpoint in COVESA vsomeip 3.7.3 and earlier trusts an attacker-declared message length before the bytes arrive — so a single 16-byte message can force a ~4 GB allocation, unauthenticated. Fixed in 3.7.4. What it is, who's affected, and the response. No exploit details.
Security configuration regresses on an ordinary merge. Our free GitHub Action runs a passive, read-only check of your public surface — headers, TLS, SSO/MFA, email auth, DNSSEC, HSTS — on every pull request, and posts the result as a PR comment. A surface check, not a pentest.
PHP patched two critical (CVSS 9.2) unauthenticated RCE flaws, dubbed PHP2Shell, on 21 Oct 2026. A plain-language advisory: what they are, who's affected, whether it's being exploited, and the first-24-hours response. No exploit details.
Almost every cloud breach starts on the customer's side of the line — a mis-scoped role, an exposed key, a public bucket. What cloud penetration testing tests, how it differs across AWS, Azure and GCP, and how to run it at the speed infrastructure-as-code moves.
Before an attacker touches your application, they scan your network — every open port, every service version, every forgotten host. What network penetration testing covers, external vs internal testing, and why a port scan is only the first step toward proof.
Prompt injection is the SQL injection of the LLM era. The real attack classes behind the OWASP LLM Top 10 — direct and indirect injection, insecure output handling, tool and agent abuse — and the defenses that hold up in production.
The real initial-access vectors behind ransomware — exposed services, weak credentials, unpatched CISA KEV entries — an SMB-sized readiness checklist, and how to find your exposure before an attacker does.
A scanner returns four thousand findings and nobody can say which one an attacker is using today. KEV answers exactly that — and almost nothing else does. How to run priority off it, where EPSS and SSVC fit, and the gap it cannot cover.
A zero-day announcement is not an incident. It becomes one only if it touches something you run, in a way that is reachable. The four questions for hour zero, how to contain what you cannot patch, and what to tell the business while you still do not know.
Every discovery pass produces the same finding: a host nobody owns, running software nobody patched, published by a certificate somebody requested two years ago. How certificate transparency, DNS and origin-IP exposure reveal it — without buying a platform.
Two things get called “the PCI scan” and only one of them produces an attestation your assessor can accept. What Requirement 11.3.2 asks for, what the ASV listing actually grants, and where a non-ASV scan earns its place between quarters.
Under CSP Level 3 a valid nonce makes the browser ignore host-source expressions for that element — so stamping every script with a nonce turns script-src into a rubber stamp. We found it on our own platform. Here is the one-line fix and a five-minute test for your site.
A broken alarm and a quiet system look identical from the outside. We audited our own monitoring and found a heartbeat with a dead payload, refund failures nobody was told about, a notification reporting work it had not done, and a gate that would have cried wolf.
A scan finds known flaws automatically; a penetration test proves which ones attackers can actually exploit. When to use each, the false-positive gap, what compliance requires, and the cost difference.
Black, grey, or white box? How the three penetration testing approaches differ in tester knowledge, cost, coverage and compliance fit — with a comparison table and when to choose each.
API penetration testing finds the access-control and auth flaws attackers reach first. The OWASP API Top 10 2023, REST vs GraphQL, the process, tools, compliance, and continuous testing.
Web app security is now a lifecycle discipline, not a code checkbox. We cover the 2026 threat landscape, what changed in the new OWASP Top 10:2025, seven best practices that move real risk, and how to test continuously from $399/scan.
A pentest runs $5,000–$30,000 in 2026 — but the range spans 10x. We break down the seven cost drivers, price by test type, the compliance premium, the ROI math, and how to get continuous coverage for a fraction of one annual engagement.
82% of ethical hackers now use AI — but it makes you faster, not smarter. We map the augmented "bionic hacker" workflow, the tool categories that matter, where AI quietly fails, and how to stay legal while testing faster.
NIS2 Article 21 is now enforceable. We walk through the seven technical control areas auditors and cyber insurers look at first — what each means in practice, the most common gap, and the evidence you need to produce.
Writing security policies is only half the battle. We explore why static GRC controls remain a compliance liability until they are backed by continuous technical verification.
Preparing for an ISO 27001 audit can feel overwhelming. We break down the key phases of Annex A controls assessment and how to streamline evidence collection.
EU NIS2 Article 21 mandates robust security incident response capabilities. We explain how to write effective containment playbooks and validate them through tabletop simulations.
Every SaaS vendor claims GDPR compliance. This post breaks down what EU data residency means at the infrastructure layer — Cloudflare Workers EU regions, Fly Frankfurt, R2 EU jurisdiction — and the audit evidence each choice produces for ISO 27001 and DORA.
AssurePort publishes its own self-pentest findings in the changelog. Radical transparency on your own vulnerabilities builds more trust than a polished security page — and we explain the responsible-disclosure process we use to do it safely.
When an AI pentest pipeline surfaces a CVE, the clock starts. This post traces the full path from finding to remediation — how AI agents generate language-specific fix code, verify the patch, and update the audit trail in under an hour.
The CISO role is changing. This post maps how AI-assisted security operations — continuous posture monitoring, automated evidence collection, risk scoring — augment lean security teams without replacing human judgement on strategic decisions.
Anonymised case study: an AI web pentest found a Broken Object-Level Authorisation paywall bypass via a /status endpoint in 31 minutes. Full curl proof-of-concept, three-line fix, and why pattern-matching scanners missed it for nine months.
A practical map of where AI-driven pentest pipelines plug a real gap — and where they absolutely do not. Drawn from 200+ conversations with security leaders in 2026. Includes the honest stack recommendation for lean teams shipping continuously.
Seven concrete things every security-tooling vendor needs to get right in 2026: Article 30 RoPA, meaningful consent, Article 32 technical measures, DPA both ways, international transfer mechanisms, retention schedules, and the AI Act shadow over model training clauses.
The architecture, the data-residency calls, and why Cloudflare Workers (EU) plus Fly Frankfurt turned out to be the right answer for a security-sensitive workload. An honest summary of the trade-offs we accepted — and the ones we did not.
DORA enforces strict operational resilience testing on EU financial entities. This post maps how continuous AI pentesting bridges the gap between triennial human red team engagements.
SAP systems house critical business processes. We explore why continuous configuration auditing across NetWeaver, ABAP, and Fiori is necessary to prevent data leakage.
Data sovereignty is now a core operational constraint. We examine how to design secure multi-tenant cloud platforms that ensure compliance with GDPR and the EU AI Act.
A side-by-side comparison of 14 engagements where a senior human red team and an AI pentest pipeline both ran against the same target within 72 hours. What each found, missed, and why.
Want us to test your stack the same way? Start your first scan in the next ten minutes. No agents to install. No prerequisites.