SonicWall’s second exploited SMA zero-day chain this year is a reminder that perimeter VPN appliances need testing and hardening, not just a patch cycle.
-
-
CBEST and STAR-FS grab the headlines, but most FCA-regulated firms need a different answer. Here is what operational resilience testing actually requires if you’re not a systemically important bank.
-
The 2025 OWASP Top 10 is a solid, data-driven baseline for web application risk. Here’s what changed since 2021, and why it should be a floor, not a ceiling.
-
Why framing in-house vs outsourced penetration testing as an either-or choice misses the point, and the hybrid model most UK businesses should actually run.
-
A critical GitLab GraphQL vulnerability let unauthenticated attackers delete public repositories, and researchers saw real exploitation attempts within two days of the patch shipping.
-
A practical guide to choosing between SAST, DAST and penetration testing, based on what you actually run, what you need to prove, and where to spend your first pound of …
-
TikTok’s $400 million COPPA settlement points to specific, checkable failures. Here’s how UK businesses can audit their own child data compliance before a regulator asks.
-
Most penetration test disputes trace back to a thin scope of work. Here is what a proper one pins down, why vague scoping backfires, and how it differs from your …
-
Have I Been Pwned onboarded Sri Lanka CERT as its 48th free government subscriber. For UK businesses, the story is about who watches your exposed staff logins, and what they …
-
Continuous threat exposure management (CTEM) is a genuinely useful framework buried under heavy marketing. Here’s what it actually requires, and where a dashboard alone falls short.