Blog & Articles

A quick way to work out whether your organisation needs ICS or SCADA penetration testing, who a genuine OT specialist looks like, and how to scope a safe first engagement.

A checklist-style guide to what a penetration testing rules of engagement document should contain, who needs to sign it, and what happens when it’s skipped.

Zero trust security stops one stolen password from reaching everything else. Here is what it takes in practice, a realistic starting checklist, and the mistakes businesses make along the way.

CVE-2026-58048 is being downplayed as low risk because it needs an existing account. On shared hosting, that’s exactly the wrong conclusion to draw.

The NHS Data Security and Protection Toolkit now expects independent, evidenced penetration testing rather than a self-declared tick box. Here’s who it applies to and what a compliant report needs.

BAS vendors call it continuous penetration testing. It isn’t. Here’s what breach and attack simulation vs penetration testing actually measures, and why you still need both.

SOC 2 never uses the words “penetration test” but most auditors expect one anyway. Here is what CC4.1 actually requires, how often to test, and what a Type II audit …

The Cyber Security and Resilience Bill never says the words penetration test, yet regulators will expect one. Here is the gap between the law and what it actually means for …

A vulnerability scan is not a penetration test, and NHS England’s own DSPT guidance says so. Here’s where submissions actually fall short, and how to fix it before an auditor …

ISO 27001, PCI DSS and cyber insurers each treat audits and penetration tests differently. Here is what each one checks, what the frameworks require, and which to book first.