Rebecca Sutton

CVE-2026-58048 is being downplayed as low risk because it needs an existing account. On shared hosting, that’s exactly the wrong conclusion to draw.

The NHS Data Security and Protection Toolkit now expects independent, evidenced penetration testing rather than a self-declared tick box. Here’s who it applies to and what a compliant report needs.

BAS vendors call it continuous penetration testing. It isn’t. Here’s what breach and attack simulation vs penetration testing actually measures, and why you still need both.

SOC 2 never uses the words “penetration test” but most auditors expect one anyway. Here is what CC4.1 actually requires, how often to test, and what a Type II audit …

A maximum-severity Metabase SQL injection vulnerability was exploited in the wild before a fix existed, and Framework and Tally have both confirmed data loss.

The Cyber Security and Resilience Bill never says the words penetration test, yet regulators will expect one. Here is the gap between the law and what it actually means for …

A vulnerability scan is not a penetration test, and NHS England’s own DSPT guidance says so. Here’s where submissions actually fall short, and how to fix it before an auditor …

New passkey attacks bypass phishing-resistant MFA on Windows and Chrome. Here is what IT teams should patch and review right now.

ISO 27001, PCI DSS and cyber insurers each treat audits and penetration tests differently. Here is what each one checks, what the frameworks require, and which to book first.

A third party data breach at Thomson Reuters exposed sealed court records and Social Security numbers across 24+ courts, and the vendor took four months to disclose it.