Security, delivery, and the attack paths between them.
I write about offensive security, identity, attack paths, AI security, third-party risk, and the operating problems behind reliable technical delivery.
The UI Is Not a Security Boundary
A hidden button or disabled menu item is a usability control, not an authorization boundary. The server still has to enforce the rule.
Secrets Tend to Live Longer Than the Systems They Belong To
Credentials often outlive the systems, projects, and people they were created for. Removing the reference is not the same as revoking the secret.
Pay Attention to What You Authorize
You do not have to share a password to give away meaningful access. OAuth grants and third-party permissions can be just as important.
Digital Identity Systems Aren’t the Target, They’re the Control Plane
Recent reports of a breach involving Sweden’s digital identity system have raised obvious concerns around data exposure and public impact. Headlines are focusing on stolen data, dark web sales, and the scale of…
Excessive Permissions Are an Attack Path Multiplier
One of the more common things we see during penetration tests isn’t a critical vulnerability or some exotic exploit.
What the Recent Iranian Hacktivist Cyberattack Teaches About Privilege Escalation
Recent reports of cyber activity attributed to the Iranian hacktivist group Handala have generated significant attention across the security community. Headlines have focused on the organizations targeted and the…
Low Severity Doesn’t Mean Low Risk
One thing that can be misleading in penetration testing is looking at every finding as if it exists by itself.
When Your Vendor Becomes Your Entry Point
Recent reporting around the Rockstar Games breach highlights a pattern that’s becoming more common and more dangerous.
Shadow IT Isn’t Just an Inventory Problem
One of the recurring things we see during external pentests is that the organization’s real attack surface is often larger than the scope everyone thinks they have.
What AI & LLM Penetration Testing Actually Looks Like
There’s a lot of talk right now about “securing AI,” and a lot of it doesn’t reflect how real systems are actually built or attacked.
What Happens After Initial Access: Why Internal Network Testing Matters
Recent incidents have highlighted a pattern we see over and over again.
What Red Teaming Actually Looks Like (And Why It’s Not Just a Bigger Pentest)
Understanding how adversary simulation differs from traditional penetration testing.
When Identity Fails: What the Kash Patel Email Breach Teaches About Personal Attack Surfaces
Recent reports confirmed that Iran-linked attackers gained access to the personal email account of FBI Director Kash Patel and released emails, documents, and photos publicly.
Project Count Is Not Capacity
Why workload planning breaks when every engagement is treated as equal, and what to measure instead.
Pentest Scheduling Starts Before a Tester Is Available
Tester availability is only one input. Readiness, scope, access, QA, and client constraints determine whether an engagement can actually start.
What Good Pentest QA Actually Looks Like
A practical QA model for separating technical validation from delivery quality without turning reporting into bureaucracy.