Notes from the field.
Practical writing on application security, penetration testing, current threats and running security in fast-moving teams.
The “Statement of Account” on WhatsApp is a program
A campaign spreading through hijacked WhatsApp accounts has moved from VBScript files to ZIP archives and disk images. How it works, which file types to stop, and what to do if someone opens one.
Security reviews that don’t block releases
Moving from a gate at the end to a conversation at the start, with a checklist you can adopt.
Your vulnerability backlog isn’t a to-do list
Why working through findings top to bottom wastes months, and a simple way to decide what to fix first.
Threat modeling in 45 minutes: a format engineers actually use
A lightweight session structure that fits inside sprint planning and still finds design flaws.
What a good penetration test report looks like
Seven things to check before you accept a report, and the red flags that mean you paid for a scan.
Five IAM misconfigurations worth checking this week
Wildcard trust policies, stale access keys and the other quiet paths to account takeover.
SAST without the noise: tuning rules for your codebase
How to cut false positives so developers stop ignoring the scanner, without losing real coverage.
Broken object-level authorization, explained with one request
The top risk in the OWASP API Security Top 10, why scanners miss it, and the pattern that prevents it.
Web application penetration testing: what to expect and how to prepare
Most of the value of a penetration test is decided before testing starts. How to scope it, what to have ready, what happens during the test and what to do afterwards.
ISO 27001 readiness: where to start and what the audit actually tests
What the standard requires, how the two-stage certification audit works, and how to prepare an information security management system that runs, not one that only exists on paper.
No articles in this topic yet. Try another filter.
Know where you stand.
Let's identify the security risks that matter most to your business.