Compliance

Attack surface management shows you what you expose. Penetration testing shows you what an attacker can do with it. Here is why one cannot substitute for the other.

BAS vendors call it continuous penetration testing. It isn’t. Here’s what breach and attack simulation vs penetration testing actually measures, and why you still need both.

SOC 2 never uses the words “penetration test” but most auditors expect one anyway. Here is what CC4.1 actually requires, how often to test, and what a Type II audit …

The Cyber Security and Resilience Bill never says the words penetration test, yet regulators will expect one. Here is the gap between the law and what it actually means for …

A vulnerability scan is not a penetration test, and NHS England’s own DSPT guidance says so. Here’s where submissions actually fall short, and how to fix it before an auditor …

A practical action plan for UK businesses that have spotted NIS2 in an EU customer contract: what Article 21 expects from testing, how often, and what evidence to keep ready.

A practical checklist for writing a vulnerability disclosure policy: what to include, what UK product security law now requires, and how it differs from a bug bounty programme or a …

PCI DSS treats network segmentation as a control you must prove, not assume. Here is what segmentation testing covers, how often you need it, and what auditors expect to see.

Vendors sell badges, but no accredited penetration testing certificate exists. What a proper report and attestation letter contain, and why the distinction matters at audit time.

Cyber Essentials is a self-signed questionnaire. Cyber Essentials Plus is what happens when someone actually checks it. An honest look at what each proves, what CE+ tests, and who really …