SAST vs DAST: 5-Step CI/CD Runbook for Developers & Security Teams
Evidence-backed SAST vs DAST for developers and security teams. Learn NIST/OWASP guidance, CI/CD scan timing, and a 5-step runbook to combine static and...
Field notes
What we keep finding, and what to do about it.
Notes from real engagements, sanitised. No listicles, no vendor comparisons, no "5 cyber threats to watch". If we write something up, it is because we saw it more than once and the fix is worth knowing.
Latest
How my AI agent saved my school during a cyberattack
A summer IT internship grew into autonomous AI that helped defend a school network during a cyberattack — and traced the attacker's origin IP address.
Read it →Security Teams: Copy Ready Penetration Testing Report Templates
Copy ready penetration testing report templates and an annotated sample for security teams. Reproducible finding fields, CVSS prioritization, and a...
Set API Rate Limits Above P95, OWASP, NGINX and Azure for Developers
For developers: API rate limiting using token bucket or sliding window with OWASP tuning. Set limits above P95 and test with NGINX and Azure.
IDOR Vulnerability: 6 Steps to Test and Fix for Developers
Hands on, test first IDOR guide for developers: follow a 6 step checklist of account swaps, method checks, and server side authorization fixes.
API Penetration Testing That Finds BOLA With ID Swaps: OWASP Aligned
Practitioner workflow for API penetration testing aligned to OWASP API Top 10. Lab-ready setup, cross-user ID tests, GraphQL/gRPC checks, and manual...
Audit Ready ISO 27001 Pentesting: Map Tests to A.8.8 and A.8.29
Make ISO 27001 pentesting audit-ready. Map tests to Annex A controls A.8.8 and A.8.29, align scope and ROE, and keep report, remediation, and retest...
Methodology First OWASP Web Application Penetration Testing for Teams
Methodology first, OWASP-aligned guide for security teams. Follow a stepwise testing process, gather proof of concept evidence, and deliver...
Continuous Penetration Testing: 90/180/365 Roadmap & CI/CD Checklist
90/180/365 roadmap and checklist to add continuous penetration testing to CI/CD and ASM, pairing automated scans with human verification.
Audit Ready SOC 2 Penetration Testing: Map Findings to Controls
Prepare SOC 2 penetration testing evidence auditors accept. Use the checklist, map every finding to TSC controls, schedule testing 8–12 weeks before...
Security Teams: Vulnerability Prioritization by Exploit Risk, Not CVSS
Operational playbook for security teams: prioritize vulnerabilities by exploit evidence (KEV, EPSS), asset criticality, runtime validation, and practical...
Control verification checklist for web apps: pre-prod vs production-like testing, evidence, and human-verified findings (2026)
Control verification checklist for web apps: pre-prod vs production-like testing, evidence, and human-verified findings (2026) In 2026, 7,851% growth in agen...
Prompt-injection testing for AI apps
A test plan for web apps that call an LLM: threat model, what to instrument, OWASP-mapped test cases, and evidence engineering can act on.
What SaaS penetration testing covers
Identity, sessions, multi-tenant authorisation and API access control — the SaaS-specific failures a general web application test tends to miss.
Sanitization vs Validation: the architectural choice that prevents code injection
Sanitization vs Validation: the architectural choice that prevents code injection In 2026, injection attacks still punch through teams that treat input handl...
5 signs your security report is noise
How to tell a report that found something from one padded with scanner output: severity inflation, no reproduction steps, and no verified impact.
Vertical vs horizontal privilege escalation: which threatens your database more?
Vertical vs horizontal privilege escalation: which threatens your database more? In practice, privilege escalation is one of the most exploited stages in the...
Checkout logic flaws scanners miss
The vulnerability classes hiding in a custom checkout that no automated scanner will flag: price tampering, coupon races, and forged payment webhooks.