vulnerability management

Five US states are suing TP-Link over its security and China claims. None of it is proven, but the same week brought five new router flaws. Here is what to …

ISO 27001 never uses the words “penetration test”, but Annex A 8.8 and 8.29 make one the evidence auditors expect. Here’s what that means in practice.

A critical WordPress core flaw, CVE-2026-87902, was being probed by attackers hours after the 22 September patch. Here’s how it works and what to do now.

Citrix’s confirmed active exploitation of an unauthenticated NetScaler exploit chain means patching alone isn’t enough. Here’s the case for treating it as a possible breach first.

Google tracked 90 zero-day vulnerabilities exploited in 2025 alone. Here’s what the term means, why enterprise software is now the top target, and how to limit the damage.

Fixing what a pen test found is only half the job. Here’s how to prioritise remediation, and why retesting is what actually proves the fix worked.

The Cisco ISE patch for CVE-2026-76460 isn’t optional. A step-by-step plan for checking versions, patching, and spotting prior compromise.

Penetration testing as a service and traditional pen testing solve different problems. A practical comparison to help UK businesses pick the right one.

A critical Cisco email gateway vulnerability shows why perimeter security appliances need the same scrutiny and testing as the applications they protect.

What a software supply chain attack actually looks like, why the numbers are rising fast, and a priority-ordered checklist UK businesses can act on this quarter.