Blog & Articles

A shrinking red number on a scanner dashboard is not vulnerability management. Here is what the process actually requires, and NCSC’s own patch deadlines.

Strip away the tooling and the reputation, and a penetration test technically matches the definition of a crime under the Computer Misuse Act. Here is why authorisation is the only …

A practical checklist for scoping SC cleared penetration testing: when the CHECK scheme makes it mandatory, why CREST accreditation isn’t the same thing, and what to ask suppliers before you …

A buyer’s guide to penetration testing methodology: what a proper process includes, red flags in a weak one, and the questions to ask before you commission a test.

Most WordPress sites are not compromised because someone singled them out. They are compromised because an automated script worked through a list of a few hundred thousand domains, tested each …

Penetration testing as a service and a traditional scoped engagement solve different problems. A side-by-side comparison and a simple way to decide which your business needs.

Black box vs white box testing comes down to how much access you give your penetration testers. Here’s how each approach, plus grey box testing, affects realism, depth, cost and …

Not sure whether to commission a penetration test or start a bug bounty programme? A practical checklist covering compliance, cost and timing for UK businesses.

The warning signs that separate a genuine penetration test from a scan with a report template, and how to choose a penetration testing company that won’t disappoint.

Commissioning PCI DSS penetration testing? What Requirement 11.4 actually obliges you to buy, and the questions to ask before you sign a quote.