Writing
Written by the people who ran the work, about the findings and failures that come up often enough to be worth generalising. No vendor announcements and no threat intelligence you cannot act on.
6 posts
Broken object-level authorisation is the finding we report most often, and almost none of it is caught by automated tooling. Here is how we test for it by hand, and the three patterns that keep producing it.
Most of the work is not security work. A plain reading of what auditors look for, which evidence is genuinely painful to produce late, and what to put in place before the observation window opens.
Plans fail at three in the morning for predictable reasons. What to strip out of yours, what to write down, and how to rehearse it so the first hour is recall rather than improvisation.
Three findings rated low can add up to full data access. How we build exploit chains during an engagement, and why severity ratings on individual findings mislead almost everyone.
Most teams collect too much of the wrong thing and too little of the right thing. A practical review of what to keep, how long to keep it, and how to check your pipeline before an incident tests it for you.
The questionnaire assumes a security programme you may not have yet. How to answer honestly, where a compensating control is legitimate, and which three answers most often stall a deal.
Working on something
Most of what we write about started as a client asking whether the thing they were worried about was real. Ask us the same question.