Non-Human Identity Risks Your Cloud Review Misses
A Terraform state file sits in a Google Cloud storage bucket. One service account can read it. That account’s key has not rotated in eighteen months. From that single credential, an attacker lists…
What Internal Pentests Miss in Hybrid Identity Environments
Most internal network pentests still run against a scope written when the environment was Active Directory on its own. In organisations that have since federated Okta or Entra ID to AD, that scope…
External Network Pentest Scope: Beyond VPN Appliances
On September 10, 2026, CISA added two MikroTik RouterOS SSH vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming what CERT Polska had already published a week earlier: attackers…
Mobile App Security Testing: What AI Code Gets Wrong
Two releases in mid-2026 have reset the ground under mobile application security work. On July 29, Zimperium’s 2026 Global Mobile Threat Report projected that “by 2027, 25% of software defects will…
Web Application Pentest Methodology: What Testers Find
The 2026 Verizon Data Breach Investigations Report confirmed a shift the report itself calls a first in its 19-year history: “Using software flaws (31%) has surpassed stolen credentials for the first…
NTLM Relay in Active Directory: What Pentests Find
An NTLM relay attack inside an Active Directory pentest remains the most reliable critical-severity finding CTDefense reproduces during internal engagements. LLMNR poisoning captures an NTLMv2 hash.…
Cloud Workload Vulnerability Testing: What CSPM Misses
Two H2 2025 threat reports converged on the same finding: known, well-catalogued weaknesses on cloud-hosted workloads have overtaken misconfiguration and credential abuse as the most common way…
Machine credentials on the dark web: what infostealers steal
The dominant mental model for dark web monitoring is still built around one credential type: a human email address paired with a password, appearing in a paste, a combolist, or an infostealer log.…
VPN Exploits: What an External Pentest Catches First
An external network pentest perimeter devices review answers a question vendor patches and scanners cannot. On 8 June 2026, CISA added CVE-2026-50751, a CVSS 9.3 authentication bypass in a widely…
Mobile Banking App Pentest: What It Actually Finds
Banking trojans no longer steal credentials and walk away. They sit on the device, overlay the legitimate banking screen, intercept the second factor, and complete the transaction while the customer…