Compliance

ISO 27001 never uses the words “penetration test”, but Annex A 8.8 and 8.29 make one the evidence auditors expect. Here’s what that means in practice.

A self-check for whether your business meets the GDPR penetration testing requirements under Article 32, what the ICO actually expects, and how to fix the gaps before an audit does.

PTaaS trades the annual pen test for a rolling subscription. Here is a practical framework for deciding whether that trade actually suits your business.

The Trust Services Criteria never mention a pentest by name, yet auditors expect one for every SOC 2 report. Here is what actually drives that expectation.

Fixing what a pen test found is only half the job. Here’s how to prioritise remediation, and why retesting is what actually proves the fix worked.

From scoping to retesting, here’s where the time actually goes in a penetration test and why the total is longer than the days you’re quoted.

Penetration testing as a service and traditional pen testing solve different problems. A practical comparison to help UK businesses pick the right one.

A cyber security risk assessment ranks your threats by likelihood and impact so security spending goes where it matters most. Here is what it covers, who needs one, and how …

PCI DSS penetration testing requirements are more than one annual test. Where the checkbox approach falls short on internal, external, segmentation and remediation obligations, and how to fix it.

A practical breakdown of DORA’s two testing tiers, the annual baseline programme and threat-led penetration testing (TLPT), with a checklist for preparing either way.