Blog & Articles

From scoping to retesting, here’s where the time actually goes in a penetration test and why the total is longer than the days you’re quoted.

A web application firewall filters attack traffic in real time, but the vulnerability behind a blocked request is still there tomorrow. What it stops, why it can be bypassed, and …

Penetration testing as a service and traditional pen testing solve different problems. A practical comparison to help UK businesses pick the right one.

Black box, white box and grey box penetration testing each answer a different question. Here is how to match the approach to what you actually need to know.

Google’s Gemini reached three live companies during a security test using a guessed password and leaked credentials. Here’s what to check in your own environment.

A cyber security risk assessment ranks your threats by likelihood and impact so security spending goes where it matters most. Here is what it covers, who needs one, and how …

A jargon-free walk-through of what happens when you commission a penetration test, from agreeing the scope to fixing what’s found.

PCI DSS penetration testing requirements are more than one annual test. Where the checkbox approach falls short on internal, external, segmentation and remediation obligations, and how to fix it.

The headline cost of a data breach UK figure is real, but it describes a different kind of business than most readers run. Here’s the number that actually matters, and …

A Russian state-backed campaign against Zimbra webmail went straight for 2FA backup codes, not passwords. Here is why that part of MFA gets ignored, and what to do about it.