Research, methodology & the occasional war story.
Notes from real engagements, VAPT methodology, and how we think about the gap between what a scanner reports and what actually gets exploited.
Cloud Penetration Testing in 2026: Why It's Now the #1 Attack Surface
IAM, misconfigured storage, the control plane — what cloud penetration testing actually covers and how it differs from a standard network pentest.
API Security Testing in 2026: The OWASP API Top 10 and What Gets Missed
Most orgs have already had an API security incident. Why BOLA keeps topping the OWASP API Top 10, and what automated scanners can't catch.
What Makes ComplyArmor Different
Armor AI chat support, stack-aware Developer Remediation, and reports built for every reader — what happens after a finding is validated that most platforms skip.
Penetration Testing for Startups: Cost, Timing & Vendor Selection
When the trigger actually arrives (a security questionnaire, SOC 2, due diligence), realistic cost ranges, what to test first on a limited budget, and how to pick a vendor.
DPDP Act Penetration Testing: What Section 8(5) Requires
India's DPDP Act never says "penetration test" — but Section 8(5) and the notified DPDP Rules 2025 make it the practical evidence you need, with a Rs. 250 crore penalty at stake.
Penetration Testing Checklist 2026: Before, During & After
What to prepare before scoping, what a tester actually checks across each phase, and what to verify once the report lands — for buyers, not just testers.
Black Box vs White Box vs Gray Box Testing Explained
What each term actually means, how much access and information the tester starts with, and which approach fits your situation.
Top 10 Penetration Testing Tools in 2026
Burp Suite, Nmap, Metasploit, ZAP, Nessus and more — what each is actually for, what's free vs. paid, and when tool output alone isn't enough for an auditor.
SOC 2 Penetration Testing: Requirements & What Auditors Expect
SOC 2 doesn't say "penetration test" — but CC4.1 and CC7.1 make it the expected evidence anyway. What auditors actually want in the report.
PCI-DSS Penetration Testing: Requirement 11.4 Explained
Unlike SOC 2, PCI-DSS names penetration testing outright. What Requirement 11.4 covers, how it differs from your quarterly ASV scan, and segmentation testing cadence.
ISO 27001 Penetration Testing: What Annex A Requires
Annex A 8.8 and A.5.36 don't say "pentest" either — but auditors expect it. How ISO 27001's risk-based cadence actually works, and where it trips people up.
HIPAA Penetration Testing: Is It Required?
Not explicitly today — but a December 2024 proposed rule would make it official, and OCR already asks for it after a breach. What's changing, and what to do now.
PTaaS Explained: What It Means, How It Works, and What to Check Before Buying
"Continuous" means something different at nearly every PTaaS vendor. A direct definition, how an engagement actually runs, and a buyer's checklist for evaluating any provider — including ours.
The AI Agent With Too Many Permissions
Why AI agents accumulate excessive permissions by default, how to test for it, and a practical least-privilege model — scoped tools, ephemeral credentials, human approval gates.
What Is Red Teaming? The Complete Guide to Red Team Testing
A lot of tools claim "red team testing" and cover a fraction of it. What real red teaming involves — goal-based adversary emulation, MITRE ATT&CK, detection evasion — and how to spot the ones that don't.
The Complete Guide to Agentic AI Security
What makes AI agents a distinct attack surface, the OWASP Agentic (ASI) Top 10 mapped in full, real incidents that already fit the pattern, and a practical testing checklist.
CVE-2026-20212: The Cisco Nexus 9000 Flaw That Turns a Management Port Into Root Access
A CVSS 9.8 unauthenticated RCE on Nexus 9000 switches needs nothing but network reachability to two undocumented ports. What's exposed, what to patch, and what a network pentest actually catches.
GitSpawn: A Booby-Trapped Repo Can Run Code the Moment Claude Code, Cursor or Codex Opens It
A newly disclosed flaw abuses git's core.fsmonitor setting to run attacker code the instant an AI coding agent opens a repo — no prompt typed, no approval clicked. Four tools fixed, four still exposed.
Agentic Browser Security: Why Atlas, Comet & Peers Break Same-Origin Policy
Real 2026 disclosures on ChatGPT Atlas and Perplexity Comet show agentic browsers resurrecting CSRF at scale. What that means and what to test before you deploy one.
SOC 2 Compliance for AI Agents: What Auditors Are Asking For in 2026
No official AICPA standard exists for AI agents yet — auditors are asking for evidence anyway. Why 88% of enterprises with agents already have an incident, and what closes the gap.
OWASP Top 10:2025 Explained: What Changed, and Why Point-in-Time Testing Misses It
2 new categories, 4 re-rankings, and Security Misconfiguration jumping from 5th to 2nd. What the data-driven reshuffle means and why an annual pentest can't keep pace with it.
Red Teaming vs Penetration Testing: What's Actually Different
These terms get used interchangeably in marketing but test different things. The real distinction, and how to know which one you actually need.
AI Agent Security in 2026: The Hugging Face Breach & EU AI Act
An autonomous AI agent breached Hugging Face using a zero-day it found itself. 88% of enterprises already have an AI agent incident. What to test for.
MCP Server Pentesting: How to Test the Attack Surface Your AI Agents Just Opened Up
Most MCP servers have never been tested by a human. What MCP server penetration testing actually involves, why your web app pentest didn't cover it, and our 7-phase methodology.
Why Autonomous Pentesting Still Needs a Human in the Loop
Automated scanners are fast at generating candidate findings and bad at knowing which ones matter. Here's what expert verification actually catches in practice, with real examples.