Mobile app penetration testing: what we test on Android and iOS
Your app runs on devices you don't control. Here's how we test what an attacker can do with it, and with the API behind it.
Blog
Practical write-ups on the vulnerabilities we test for and how to fix them.
Azure penetration testing: where cloud environments really break
In Azure, the biggest risks are rarely software bugs. They're identities with too much access and settings nobody checked.
Red team vs penetration test: which one do you actually need?
Both involve ethical hackers attacking your systems. They answer very different questions.
How to prepare for a penetration test: a checklist for your team
Most of a pentest's value is decided before testing starts. Here's what to sort out first.
Critical, high, medium, low: how to read a pentest report's severity ratings
A 9.8 doesn't always mean drop everything, and a 4.3 isn't always safe to ignore.
IDOR: the one-line bug behind many API data leaks
Change one number in a request and see someone else's data. Here's why this keeps happening, and how to stop it.
The OWASP API Security Top 10, explained for developers
APIs carry most of your data now. These are the ten ways they most commonly fail.
CERT-In's 6-hour incident reporting rule: what Indian businesses need in place
Six hours isn't long. If an incident happened tonight, would you know, and could you report it in time?
AWS security: the misconfigurations we find in almost every account
Most AWS breaches don't need a zero-day. They need one overly generous policy.
Prompt injection: how attackers turn your AI feature against you
If your product sends user content to a language model, someone will try to give that model new instructions.
Securing your CI/CD pipeline: the attack path most teams forget
Your pipeline can deploy to production and holds your secrets. Attackers know that.
Phishing simulations that actually change behaviour
The goal isn't catching people out. It's making reporting a suspicious email the instinctive thing to do.
SAST, SCA, IaC scanning and SBOMs: which does your team need?
Four acronyms, four different kinds of risk. A short guide to what each one checks and where to start.
Kubernetes security: common mistakes in AKS, EKS and GKE clusters
Managed Kubernetes handles the control plane. Workload security is still on you.
SOC 2 or ISO 27001: which should your startup get first?
Your enterprise customer is asking for one of them. Here's how to decide which, and what each involves.
Find out what an attacker would find.
Tell us what you need tested. We'll send a scoped quote within one business day.