OWASP

A plain-English guide to the web application firewall: what it blocks, the main types, where it falls short, and how it fits with penetration testing.

AI penetration testing checks chatbots, copilots and AI agents for prompt injection, data leaks and tool abuse. Here is what it covers and how to scope one.

A plain-English guide to the secure code review process: what reviewers check, how it differs from SAST and penetration testing, and when to bring in an outside expert.

Cross-site scripting lets attackers run their own code in your users’ browsers. Here is how XSS works, the three main types, and the layered defences that stop it.

A plain-English guide to testing an online shop: what testers check, how it differs from a scan, what PCI DSS expects and how to scope the work.

Cross site scripting lets attackers run their own code in your visitors’ browsers. Here are the three types, what the damage looks like and how to fix it.

The 2025 OWASP Top 10 is a solid, data-driven baseline for web application risk. Here’s what changed since 2021, and why it should be a floor, not a ceiling.

The OWASP Top 10 was rebuilt for 2025. Here is what moved, what is new, and the questions worth asking before your next web application penetration test.