A practical breakdown of DORA’s two testing tiers, the annual baseline programme and threat-led penetration testing (TLPT), with a checklist for preparing either way.
Category:
Blog & Articles
-
-
A practitioner’s view on setting third party penetration testing requirements: what to ask suppliers and vendors for, how to tier them by risk, and where GDPR, ISO 27001 and PCI …
-
What a software supply chain attack actually looks like, why the numbers are rising fast, and a priority-ordered checklist UK businesses can act on this quarter.
-
DfE standards do not require it and Cyber Essentials does not test it. Here is what a penetration test for a school covers, and why the compliance gap matters.
-
An insider threat comes from someone who already has legitimate access to your systems. Here’s what the main types are, what they cost, and how to reduce your risk.
-
Banning shadow IT rarely works. Here’s why the NCSC recommends a no-blame approach, what actually reduces unsanctioned tech, and how it changes what your penetration test should cover.
-
IT teams drown in critical CVSS scores every month. Here’s what the score actually measures, how to read the severity bands, and how to prioritise patching when everything looks urgent.
-
PSTI compliance bans default passwords and demands update transparency, but government testing shows compliant devices can still fail badly under real testing.
-
Thinking about commissioning container penetration testing? What it covers, how it compares to a cloud pentest, what drives cost, and what to ask a provider first.
-
Two pentest quotes, three times the price difference. Here’s how to tell a genuine manual penetration test from an automated scan with a PDF wrapper.