ISO 27001 never uses the words “penetration test”, but Annex A 8.8 and 8.29 make one the evidence auditors expect. Here’s what that means in practice.
-
-
A CIS Benchmark scan checks configuration, not chained attack paths. Here’s why Kubernetes penetration testing catches what automated scanning misses.
-
A self-check for whether your business meets the GDPR penetration testing requirements under Article 32, what the ICO actually expects, and how to fix the gaps before an audit does.
-
A critical WordPress core flaw, CVE-2026-87902, was being probed by attackers hours after the 22 September patch. Here’s how it works and what to do now.
-
PTaaS trades the annual pen test for a rolling subscription. Here is a practical framework for deciding whether that trade actually suits your business.
-
Blog & Articles
Could Your Staff Be Talked Past Your Security? Social Engineering Penetration Testing Explained
What social engineering penetration testing reveals about the untested assumptions behind your security, how it works, what it costs, and whether it’s legal in the UK.
-
News
What to Do When Your File-Transfer Vendor Tells You to Shut Down: Lessons From the Kiteworks Security Incident
Kiteworks asked customers to power down for nine hours after a credible threat warning. Here’s a practical checklist for businesses that depend on any secure file-transfer platform.
-
A firewall that’s fully patched can still be compromised. Firewall penetration testing explained, with what it checks and how often to run one.
-
Citrix’s confirmed active exploitation of an unauthenticated NetScaler exploit chain means patching alone isn’t enough. Here’s the case for treating it as a possible breach first.
-
Google tracked 90 zero-day vulnerabilities exploited in 2025 alone. Here’s what the term means, why enterprise software is now the top target, and how to limit the damage.