Blog · Security Research · Field Notes
Offensive security deep-dives from the field.
Pen testing walkthroughs, compliance field notes, cloud attack chains and thought leadership from the CyberFortify offensive security team. Written by practitioners, for practitioners.
CSRF (cross-site request forgery) explained
The attack that turns your logged-in users into accomplices - their own browser fires an unwanted authenticated request. How it works, and the two fixes that stop it: anti-CSRF tokens and SameSite cookies.
SSRF (server-side request forgery) explained
Make the server the attacker's proxy - reaching internal systems the internet can't. Why the cloud makes it lethal (metadata credential theft), what it can reach, and how to shut it down.
IDOR (insecure direct object reference) explained
Change one number, read someone else's data. The simplest serious web bug, why it's OWASP #1, why scanners structurally miss it, and the one fix that matters: server-side authorization on every object.
Open redirect vulnerability explained
It steals nothing on its own - its danger is borrowed trust. A link that starts on your domain but forwards to an attacker's page. Why it supercharges phishing and OAuth theft, and the allowlist fix.
File inclusion (LFI & RFI) explained
When user input picks which file to load, an attacker loads the wrong one - or code the server executes. How LFI escalates from file read to RCE, how it differs from traversal, and how to prevent it.
Wi-Fi & wireless penetration testing explained
Your firewall stops at the wall - your Wi-Fi signal doesn't. The physical attack surface anyone nearby can reach, rogue and evil-twin APs, and the make-or-break question: does guest Wi-Fi reach the internal network?
Microsoft 365 & Entra ID (Azure AD) penetration testing
The network is no longer the boundary - identity is. Why cloud identity is the new perimeter, the phishing, token-theft, consent-abuse and conditional-access-gap risks, and what a tenant test covers.
IoT device penetration testing explained
A connected device is five attack surfaces in one - hardware, firmware, comms, app, cloud - and attackers use whichever is weakest. The risks by layer, and why one flaw can affect an entire fleet.
Social engineering & phishing simulation testing explained
Attackers go around the tech, straight at people. Why humans are the most reliable way in, the phishing/vishing/pretexting/tailgating techniques, how a phishing simulation runs, and how to do it ethically.
Purple teaming explained: red + blue, together
A red team stays hidden to test if you'd notice; a purple team does the opposite - attackers and defenders side by side, tuning detection in real time. How it works, how it differs from red teaming, and when it pays off.
SQL injection explained: how it works & how to stop it
The classic critical flaw — user input reaching a database query unsafely. In-band, blind and out-of-band types, real impact, and the one real fix: parameterised queries.
Cross-site scripting (XSS) explained
Attacker script running in your users' browsers. Stored, reflected and DOM-based XSS, what it enables — session theft, account takeover — and the layered fix: output encoding, CSP and HttpOnly.
LDAP injection explained
The injection flaw that hits directory-backed logins — auth bypass and directory enumeration when input reaches an LDAP filter unsafely. How it works and the safe-API fix.
Directory / path traversal explained
The ../ trick that reads files outside the web root — config, credentials, source. Encoding bypasses, real impact, and safe path construction.
Penetration testing for aviation
Airlines and airports — loyalty/miles fraud, a huge IT estate, and the safety-critical OT boundary. Why aviation is a high-stakes target and what a test must cover.
Penetration testing for law firms
A firm's whole value is confidentiality — and it holds client secrets, deal material and moves large client-money transfers. The two risks that dominate, and why clients now demand a test.
NIST CSF penetration testing requirements
Voluntary and outcome-based — so it never says 'pentest,' but its Identify and Protect outcomes point straight there, and it maps to SP 800-53 which does. How testing evidences the framework.
CMMC penetration testing requirements
The US DoD supply-chain certification, built on NIST SP 800-171. The levels, who must comply, and how testing validates that controls protect CUI — not just exist on paper.
Citrix, VDI & remote-access penetration testing
Internet-facing gateways into your network — actively exploited for initial access. Two directions: breaching the gateway, and breaking out of a locked-down session. What a test covers.
Penetration testing for automotive & connected vehicles
A modern car is a computer on wheels — a large, safety-critical surface reachable remotely and exploitable at fleet scale. What to test across telematics, apps and backends, and UNECE R155 / ISO 21434.
How much does penetration testing cost?
The price is a count of tester-days, driven by scope, complexity and depth — not a fixed rate. The cost drivers, typical ranges, and how to scope for value without paying pentest rates for a scan.
OWASP Top 10 (2021 → 2026): lessons from real engagements
The OWASP Top 10 as it actually shows up in the field — which categories we find most, why broken access control leads, and what the list means for how you should be tested.
Penetration testing services in California
California's drivers are commercial — the enterprise deal that won't close without a test, the SOC 2 the customer demands, and the CCPA/CPRA reasonable-security duty. What it covers, cost, and remote delivery across the state.
Penetration testing procurement: a guide for procurement teams
Testing is the category where "compare on price" backfires — two identical-looking quotes can be a real engagement and a scanner with a cover page. How procurement should buy it: quality first, red flags, and a scorecard.
Penetration testing for gaming & online gambling
Gaming mixes real money, valuable virtual economies and huge user bases — the combination attackers love. In-game economy abuse, account takeover, and why the server must enforce every rule the client can't be trusted with.
Docker & container security
A container feels like a VM but isn't — it shares the host kernel, so isolation is weaker. Get the privileges wrong and one compromise escapes to the host and every other container. The attack surface, testing, and hardening.
WordPress security & penetration testing
WordPress runs a huge share of the web — one plugin flaw hits thousands of sites automatically. The key insight: the core is solid; the risk lives in the plugins and themes. Where a test looks, and how to harden it.
Deepfake & voice phishing: the AI social engineering threat
What stops your staff when they hear their CEO's actual voice — cloned from a conference talk — urgently instructing a payment? Why email training fails, how to test resilience, and the process controls that stop it.
Prototype pollution explained
Almost every JavaScript object inherits from one shared parent — so if an attacker adds a property there, they've changed every object at once. From security-check bypass to DOM XSS and Node.js RCE.
Command injection explained
Some apps hand user input to the OS shell to do their work — and if it isn't handled carefully, an attacker slips in their own commands. One of the shortest paths from a text box to full server compromise.
JWT attacks explained
A JSON Web Token says who you are and what you can do — and the only thing between an attacker and forging an admin token is the server checking the signature. alg:none, algorithm confusion, and how to use JWTs safely.
Do you need a penetration test for SOC 2?
The honest answer to the most-Googled SOC 2 question: not named, but effectively expected. Which Trust Services Criteria drive it, what auditors and customers want, Type I vs Type II timing, and making one test serve the audit.
Thick client & desktop application penetration testing
A thick client runs on the attacker's machine — they own the device, binary and memory, so any client-side control can be defeated. The real question is whether your backend still holds the line.
Penetration testing services in Oman
Oman layers the CBO for finance, the PDPL for personal data, and national cyber security expectations. What a Muscat engagement covers, what it costs, and why local fluency gets your report accepted first time.
Penetration testing services in Kuwait
Kuwait layers the CBK for finance, CITRA's data privacy regulation, and national cyber security expectations. What a Kuwait City engagement covers, what it costs, and why local fluency matters at deadline.
GDPR penetration testing requirements explained
GDPR never says "penetration test" — but Article 32 requires you to "regularly test the effectiveness" of your security measures, and testing is how. It reaches GCC firms with EU customers or data, too.
Penetration testing for education
A university holds huge volumes of student data and research, yet runs one of the most open networks anywhere — often on a tight budget. Why the sector gets ransomwared, and what a test must cover.
Penetration testing for real estate & proptech
A property deal moves an enormous sum in one transaction — and attackers know it. Why real estate is a magnet for payment-diversion fraud and data theft, and what a test must cover across portals, CRM and payments.
CORS misconfiguration explained
CORS relaxes the browser's same-origin policy — relax it too far and an attacker's site can read your logged-in users' data. The dangerous configs, what an attacker steals, and how to lock it down.
Web cache poisoning explained
A cache serves one stored response to many users — so if an attacker gets it to store a malicious one, every visitor after them is compromised. The cache-key theory, cache deception, and how to close the gap.
File upload vulnerabilities explained
"Upload your profile picture" lets a stranger place a file of their choosing on your server — and if it's a script in an executable spot, that's a web shell. The bypasses, the other damage, and the one fix that matters most.
Salesforce security assessment & testing
Salesforce holds your customers, pipeline and contracts — and its security depends far more on how you configured it than on Salesforce's platform. The misconfigurations that expose data, and why it needs specialist testing.
Penetration testing ROI: making the financial case
"What's the ROI?" is a fair question and a slightly wrong one — the main return is a loss that never happens. An honest framework: where value really comes from, why the maths is fragile, and how to persuade finance.
Penetration testing services in Qatar
Qatar layers the QCB for finance, the NIA framework for government and critical sectors, and the PDPPL for personal data. What a Doha engagement covers, what it costs, and why local fluency gets your report accepted first time.
The CISO's guide to a penetration testing programme
One test is an event; a programme is a capability. How to set a risk-based calendar, choose engagement types, drive remediation, and report posture to the board as a trend line, not a pass/fail.
Penetration testing for startups
You don't need a pentest because a calendar says so — you need one because an enterprise deal, a SOC 2 audit or an investor demands it. The pragmatic founder's guide: when, what to test, and how much.
Race condition & TOCTOU testing
Your app checks the balance, then makes the withdrawal — and 50 requests at once can pass the check before any updates it. How a single-use coupon gets used a hundred times, the single-packet attack, and the atomic fix.
HTTP request smuggling explained
When a proxy and the server behind it disagree on where one request ends, an attacker slips a hidden request across the seam — onto the next user's traffic. The desync, the CL.TE/TE.CL variants, and how to shut it down.
AI supply chain & model security
You didn't build most of your AI system — you assembled it from downloaded models, datasets and ML libraries, and some can execute code the moment you load them. The risk map, how to test it, and how to defend it.
The most common vulnerabilities we find
The same handful of flaw classes come up again and again — and they're rarely exotic. A field view aligned to the OWASP Top 10: broken access control leads, business logic follows, and almost none of it is anything a scanner flags.
The cost of a data breach in the GCC (2026)
The GCC isn't a discount region for cyber incidents — it's one of the most expensive in the world. IBM puts a Middle East breach at ~SAR 27M (~$7.3M). What it includes, why the region ranks so high, and how testing cuts it.
Penetration testing statistics 2026
The numbers that make the case — breach cost, the weaknesses attackers actually exploit, testing adoption, remediation speed — every figure cited to IBM, Verizon and the regulators, with a GCC and global focus.
10 signs of a bad penetration test (red flags)
Was it a test — or a scanner's output with your logo on it? The ten red flags in the report and process that tell you the test was shallow, and what a good one looks like instead.
How to define penetration testing scope
Scope is the most important decision you make about a test — and it happens before anyone touches a keyboard. What to include, what to gather, which box-colour to pick, and the two classic mistakes.
Penetration testing for logistics & supply chain
Stop a logistics operator and you stop the movement of goods. Why ransomware loves the sector, the sprawling EDI/API partner surface, and testing port and warehouse OT safely.
Penetration testing for hospitality & hotels
A hotel holds your card and your passport, across a PMS, POS, booking engine, guest Wi-Fi, loyalty and door locks. Why hotels get breached, what PCI and PDPL require, and what a test must cover.
OAuth & SSO security testing
SSO sits in front of everything, so a login-flow flaw is account takeover for the whole app. The common OAuth, OIDC and SAML flaws — and why using Google or Okta doesn't fix an insecure integration.
Server-side template injection (SSTI) explained
A single {{7*7}} that returns 49 is the tell — and from there it's often a short climb to running commands on your server. How SSTI works, the detect-then-escalate method, and how to design it out.
Insecure deserialization explained
It turns a routine "rebuild this object from bytes" into running the attacker's code on your server — from one crafted input, no credentials. How serialized data becomes RCE, and what a gadget chain is.
XXE injection explained
Hand an XML parser a booby-trapped document and it will fetch a file off the server or fire a request at an internal system. How XXE works, and where it hides — SOAP, SAML, and every DOCX or SVG upload.
HIPAA penetration testing requirements explained
HIPAA never says "penetration test" — but the risk analysis and evaluation standards require you to find and evaluate technical risks to ePHI, and testing is how. Who's in scope, how often, and what OCR expects.
PDPL penetration testing requirements (Saudi & UAE)
The Saudi and UAE PDPLs don't say "you must pentest" — but both demand you secure personal data and prove it works. How testing evidences the duty, and the cross-border data trap that catches GCC firms.
OWASP API Security Top 10 explained (2023)
APIs broke the old rulebook — the top threats are authorisation flaws, not injection. Each risk from BOLA to unsafe third-party consumption, how it's exploited, and how to test and fix it.
SWIFT CSP assessment & penetration testing explained
If you send payments over SWIFT, the CSP is mandatory. The CSCF controls, the secure zone, the annual attestation, and where pentesting fits — alongside your SAMA or CBB obligations.
CI/CD pipeline security testing: attacks & defences
Your pipeline holds the keys to everything and runs code on every push — the highest-value asset most pentests skip. Poisoned execution, secret sprawl, supply-chain integrity, and how to test it.
15 questions to ask a penetration testing vendor
Every quote looks similar on paper — and some hide a scanner with a cover page. The 15 questions that separate a real provider from a scan-and-invoice shop, with ideal answers and red flags.
Penetration testing services in Abu Dhabi
Abu Dhabi runs its own regimes — ADHICS for healthcare, the FSRA for ADGM — over the federal UAE IA and PDPL. What an engagement covers, what it costs, and why local fluency gets your report accepted first time.
Penetration testing for manufacturing (IT/OT)
Downtime is money per minute — which is why factories are a ransomware favourite. The IT/OT convergence risk, what to test across ERP, MES and SCADA, and how to test live production without breaking it.
Penetration testing for retail & POS
Retail spreads card data and customer records across the widest attack surface in business. Why retailers get hit, the PCI/PDPL drivers, and the business-logic flaws that hit the P&L directly.
ISO 27001 penetration testing requirements explained
ISO 27001 never says "pentest must be performed" — but Annex A A.8.8 and A.8.29 require it in practice, and auditors expect it. How testing maps to the standard, how often, and what evidence closes the loop.
PCI DSS 4.0 penetration testing requirements
If you touch card data, Requirement 11.4 is non-negotiable: internal and external tests every year and after change, plus segmentation testing. Exactly what PCI v4.0 asks, the cadence, and who can test.
Mobile app security testing checklist (iOS & Android)
A mobile app ships your code to a device the attacker controls. The OWASP MASVS checklist across storage, crypto, cert pinning, platform IPC and code protection — plus the backend API, where the real risk lives.
What happens after you book a pentest: the engagement timeline
Scoping, kickoff, testing, live critical alerts, reporting, readout, remediation, retest — every stage of an engagement and exactly what's needed from you at each one.
Penetration testing for insurance companies
Insurers concentrate health, identity and payment data and move money. Why they're a prime target, the CBB/NCA/PDPL/PCI drivers, and the business-logic flaws that expose one policyholder to another.
NIS2 vs DORA: penetration testing requirements compared
Two EU regimes, two testing bars — DORA's TLPT threat-led red teaming vs NIS2's risk-based testing. Who each applies to, what it mandates, and how GCC firms with EU footprints get reached.
SAP security assessment & penetration testing
SAP runs your finance and supply chain on its own protocols. Why it needs specialist testing — Gateway, RFC, ABAP, roles and SoD, plus the Fiori/OData surface — without breaking production.
Session management testing checklist (web apps)
A stolen token lets an attacker be your user. Cookie flags, token entropy, session fixation, timeout, logout invalidation, concurrent sessions and JWT pitfalls — OWASP-mapped, with how-to-test notes.
White-label penetration testing for MSPs & agencies
Offer pentesting under your own brand without hiring a red team. How the partner model works, what gets branded to you, the margins, and keeping quality when the delivery isn't yours.
Vendor security questionnaires: the pentest questions decoded
A prospect sent a 200-row security questionnaire. What each pentest question really asks, how to answer honestly without over-committing, and exactly what evidence to attach.
Pentest requirements for Vanta, Drata & Secureframe users
Your compliance platform flagged a pentest evidence gap. The tool doesn't run the test — here's exactly what it needs from a third-party report, and how to time it to your audit window.
Local vs offshore penetration testing: which is right for you?
Offshore wins on day rate; local often wins on total cost once you count rework, data residency and regulatory mapping. An honest decision framework — and when offshore genuinely wins.
Penetration testing services in Dubai
Dubai layers DESC ISR, DFSA/DIFC data law, UAE IA and PDPL. What a Dubai engagement covers, what it costs, and why regional fluency decides whether your report is accepted first time.
Best penetration testing companies in Bahrain (2026)
Ten providers with a genuine Bahrain presence — the Beyon, CTM360 and telco players — with a comparison table, the exact CBB reporting cycle, cited stats, and a scored method.
Best penetration testing companies in Saudi Arabia (2026)
Eleven providers a Saudi buyer should know — NCA-licensed SOC operators, Aramco- and stc-backed players, and the Big 4 — with a comparison table, NCA/SAMA regulator map, cited stats, and a scored method.
Best penetration testing companies in the UAE (2026)
Eleven providers a UAE buyer should know — with HQ, focus and accreditations, a comparison table, a DESC/NESA regulator map, cited breach stats, and the scored method we used to rank them.
Web application penetration testing cost: what drives the price
The price is a count of tester-days — driven by app size, roles, business logic and depth. The six cost drivers, and how to scope for value without paying pentest rates for a scan.
PTaaS vs traditional penetration testing
A platform-delivered model adds real continuity — or hides automated scanning behind a dashboard. The delivery model doesn't answer the only question that matters: how much is manual?
Subdomain takeover: detection and prevention
A dangling DNS record pointing at a deprovisioned service lets anyone claim a subdomain of your domain — inheriting your brand's trust for phishing and worse. How to find and fix it.
Mass assignment vulnerabilities in modern frameworks
The one-line binding that saves a form is the same one that lets an attacker set isAdmin by adding a field. Why it's in the OWASP API Top 10, and the allow-list fix.
LLM jailbreak testing for production applications
Once your branded assistant is producing harmful output, it's your incident — whoever typed the prompt. How jailbreaks defeat guardrails, and how to test and defend in layers.
Penetration testing services in Bahrain
Bahrain's financial sector runs on the CBB's twice-yearly clock. What a Kingdom engagement involves, what it costs, and why a report mapped to CBB reporting matters at deadline.
Penetration testing for e-commerce & retail
The dangerous flaw is a checkout that lets someone buy a $1,000 item for $1, or a script quietly skimming cards. Testing the money and the logic, mapped to PCI DSS.
Building the business case for a penetration test
"We should be more secure" doesn't win budget. The four arguments leadership responds to — revenue, risk, compliance, due diligence — and how to tie them to a trigger.
Kubernetes & container security testing
One misconfigured permission or over-privileged container turns a single pod into cluster control. The real attack surface — RBAC, container escape, secrets — and how to harden it.
Writing a remediation plan your auditor will accept
Auditors want findings managed, not just fixed. The fields each finding needs, how to prioritise, how to document accepted risk, and the retest that closes it out.
Kerberoasting: how it works and how to stop it
Any domain user can crack service-account passwords offline, with no exploit and no lockouts. How the attack works step by step, why it succeeds, and the fixes that stop it.
GraphQL penetration testing: attack surface and method
Introspection, nested-query DoS, BOLA, batching abuse and injection — the GraphQL-specific flaws a tester who treats it like REST will miss, and how to secure them.
RAG security: how retrieval pipelines leak data
The model isn't the weak point — the retrieval layer is. How missing access control, indirect prompt injection and knowledge-base poisoning turn AI assistants into leak channels.
MCP & AI agent security testing
Give a model tools and prompt injection stops being a text problem and becomes a real one. Excessive agency, tool poisoning, and how to verify a compromised model can't compromise the system.
DORA TLPT requirements for EU financial entities
DORA's threat-led penetration testing — who's in scope, how often, the TIBER-EU basis, and why it's a red-team-style step change from a standard pentest.
The penetration test attestation letter, explained
The shareable proof that testing happened — what it contains, how it differs from the full report, and why it's often the artefact that unblocks an enterprise deal or audit.
Penetration testing RFP template: what to ask and include
Nine sections and the questions that separate real, human-led testing from a scan in a nicer PDF — so you get comparable proposals and buy the right thing.
In-house vs outsourced penetration testing
Not a cost decision but a choice between independence and intimacy — why an internal team and an external provider solve different problems, and why most need both.
VAPT services in Saudi Arabia: engagements, costs, timelines
The NCA, SAMA and PDPL drivers, what a KSA engagement covers, timelines and cost drivers — and why a report not mapped to your control set gets sent back.
What to do when you "fail" a penetration test
A pentest isn't pass/fail — a report full of criticals did its job. The calm, structured response: triage, remediate, retest, communicate, and fix the root causes.
Penetration testing requirements by framework: a master comparison
What SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, CMMC, FedRAMP, NIST and the GCC regulators each require — explicit vs expected, cadence, and how one test can satisfy several.
What is red teaming? And when you're not ready for it
A goal-based, adversarial simulation that tests detection and response — how it differs from a pentest, and the honest signs a purple team is your smarter first step.
Black box vs gray box vs white box penetration testing
How much the tester knows changes everything — realism, coverage, cost. Why gray box is the pragmatic default for application testing.
Internal vs external penetration testing
External tests whether the front door holds; internal tests what happens once someone's in. Why real breaches need both — and PCI DSS requires them.
Vulnerability scanning vs penetration testing vs bug bounty
Breadth, depth-on-a-schedule, or continuous crowd coverage — what each is for, why a bounty can't replace a pentest, and how to layer them.
Business logic vulnerabilities and why scanners miss them
Abusing legitimate features without breaking a single technical rule — why automated tools are structurally blind to them, and how manual testing finds them.
Retesting after remediation: how it works and what it proves
Turning "we fixed it" into "it's proven fixed" — how a retest verifies closure, catches failed fixes, and produces the attestation auditors and customers want.
AI red teaming vs AI penetration testing
One secures the whole LLM application against the OWASP LLM Top 10; the other stress-tests the model's behaviour. When you need which — and where they overlap.
GCC cybersecurity compliance calendar: testing deadlines by regulator
The penetration testing cycles for CBB, NCA, SAMA, the UAE, Qatar, Kuwait and Oman — and the buying windows to book testing before each deadline.
Best penetration testing companies in the GCC: how to evaluate them
The market's three tiers and the six criteria that actually decide quality — a framework to judge any provider (us included) on the merits, with disclosure.
What is penetration testing? A practitioner's guide
The cornerstone definition: an authorised, simulated cyberattack that finds and safely exploits vulnerabilities before real attackers do — its purpose, seven phases, types and who needs one.
Penetration testing vs vulnerability assessment: a complete comparison
One finds and ranks weaknesses at breadth; the other exploits them to prove impact at depth. The full comparison, why compliance treats them separately, and what VAPT means.
How often should you run a penetration test?
At least annually and after any significant change — with cadence driven by compliance (PCI 11.4), risk and rate of change. Where continuous testing fits.
Penetration testing methodology: PTES, OWASP & NIST SP 800-115
The main methodologies explained and compared — and how a rigorous test combines a process standard with OWASP's technical checklists, mapped to MITRE ATT&CK.
How to prioritise and triage penetration test findings
Rank by real risk, not raw CVSS. Separate quick wins from strategic fixes, set severity-based SLAs, handle accepted risk, and close the loop with a retest.
AWS vs Azure vs GCP: penetration testing rules of engagement
What each cloud allows — AWS permitted services, Azure's dropped notification (2017), GCP's no-contact rule — and the prohibitions common to all three.
Active Directory attack paths found in most internal tests
Poisoning and relay, Kerberoasting, ADCS ESC, delegation abuse — the recurring path to Domain Admin, why it exploits defaults not bugs, and how to close it.
How to choose a penetration testing company: 20 questions to ask
Twenty questions across credentials, methodology, scope, reporting and commercials — so you buy real, human-led testing and not a rebranded scan.
Penetration testing for SaaS startups: SOC 2 ready
Satisfy SOC 2, pass enterprise security reviews, and prove multi-tenant isolation — testing scoped and timed for a SaaS startup and its budget.
Penetration testing for fintech: where the real risk is the logic
Payment and transaction logic, API-first architectures, wallets and open-banking integrations — mapped to PCI DSS, SAMA and CBB. Why business logic is the crown jewel.
The OWASP LLM Top 10 (2025) explained, with how each is tested
All ten 2025 risks — from prompt injection to unbounded consumption — what each means, the two new entries, and how an AI penetration test assesses them.
Prompt injection testing: the #1 LLM risk, and how we find it
Direct vs indirect injection, the real-world variants, why it's considered unsolved, how an AI pentest finds it, and the mitigations that genuinely reduce the risk.
Penetration testing glossary: 55 terms defined
A plain-English reference — from BOLA and SSRF to CVSS, red teaming and prompt injection — grouped by category, each defined in a sentence or two.
The board is asking about security posture — how to answer with evidence
What directors actually want to hear, how a penetration test gives you the independent evidence to answer, and how to present results at board level.
Do you need a penetration test before launch?
When a pre-launch test is essential, when you can defer, what to test, and how to fit it into your release timeline without slipping the date.
We've been breached — what to do in the first 72 hours
Contain, preserve evidence, meet GCC notification deadlines, and where penetration testing fits once the fire is out. A calm, practical guide.
Qatar penetration testing requirements: QCB & the NIA Policy
QCB requires semi-annual VAPT and two penetration tests a year for banks; the NIA Policy sets an annual security assurance plan for government. The Gulf's most specific mandate, in its own words.
Kuwait penetration testing requirements: the new CBK CORF
The CBK Cyber & Operational Resilience Framework (Dec 2025) replaced the 2020 CSF and added mandatory annual red teaming, plus IoT/OT testing. Control-by-control.
Oman penetration testing requirements: CBO & MTCIT
The CBO CS&RF mandates VAPT for financial institutions; MTCIT accredits providers for government testing. An honest guide — including where the public control text runs out.
Your cyber insurance requires a penetration test — what to do
Why insurers ask, what actually satisfies them, how a pentest affects your premium and coverage, and the claim-denial trap of misrepresenting your security on the application.
Your auditor rejected your vulnerability scan — why a scan isn't a pentest
Why a scan doesn't satisfy SOC 2, PCI DSS or ISO 27001, the real difference between the two, and how to fix it fast with an audit-ready penetration test.
Your first penetration test: a guide for first-time buyers
What a test is, whether you need one, what to expect, how to scope your first engagement, what you'll receive, and the first-timer mistakes to avoid.
Security due diligence in M&A: what acquirers actually check
What cybersecurity due diligence covers, why a penetration test moves valuation and deal risk, and how to prepare whether you're buying or being bought.
The types of penetration testing (and which one you need)
Tests are categorised three ways — by target, by tester knowledge (black/grey/white box), and by perspective (external/internal). Understand the axes to scope the right test.
We failed our SOC 2 audit — what happens next?
What a qualified opinion really means, why a missing penetration test is a common cause (CC4.1 names it), and the exact path back to a clean report.
How long does a penetration test take? Real timelines
One to three weeks of testing plus reporting — but scope decides. Timelines by test type, what drives duration, the full engagement timeline, and how to speed it up.
How to prepare for a penetration test: a pre-engagement checklist
The difference between a smooth, high-value test and a slow one is decided before day one. Scope, access, environment and stakeholders — plus a ready-to-use checklist.
UAE IA Regulation (NESA) penetration testing requirements: control T7.7.1
What the UAE Information Assurance Regulation — the standard most still call NESA — requires of security testing, its priority-P1 control, who complies, and how it links to ADHICS and DESC.
ADHICS penetration testing requirements: control OM 7.1 for Abu Dhabi healthcare
Abu Dhabi's healthcare standard names penetration testing, vulnerability assessment and web security assessment on a yearly schedule. What OM 7.1 requires, the tiers, and how it maps to UAE IA.
DESC ISR penetration testing requirements: Dubai's information security regulation
What Dubai's DESC ISR expects of security testing, who it binds, and what can honestly be said about cadence given the control catalogue is access-restricted.
Manual vs automated penetration testing: what each actually finds
Scanners are fast; humans find the access-control and business-logic flaws behind real breaches. What each does well, why "automated pentest" misleads, and how to use both.
How to read a penetration test report, section by section
Executive summary, scope, findings, CVSS severity, proof of concept, remediation — what every part means, and exactly what to do with the report once you have it.
Your customer wants a pentest report: what they actually need
An enterprise customer made a penetration test report a condition of the deal. What they actually want, what counts as acceptable, what to send, and how to get one without stalling the contract.
Boutique vs Big 4 penetration testing: which fits a regulated buyer?
An honest comparison — where each genuinely wins on depth, price, procurement and tester seniority, and the one question that matters more than firm size: who actually holds the keyboard?
Penetration testing requirements by framework: the 2026 finder
Select your framework — CBB, SAMA, NCA ECC, PCI DSS, SOC 2, HIPAA, ISO 27001, FedRAMP, DORA — and get the exact testing frequency, scope, mandatory status and control reference.
How much does penetration testing cost in 2026?
The honest answer is a range: $4,000 to $150,000+, most engagements $10,000-$30,000. Real 2026 prices by test type, methodology, pricing model and compliance framework, plus a GCC note.
SAMA CSF penetration testing & red teaming: the 2026 guide for Saudi financial institutions
Control 3.2.4 requires annual penetration testing; the separate FEER framework requires red teaming every three years. The maturity model, who must comply, and how SAMA sits alongside the NCA ECC.
NCA ECC penetration testing requirements: control 2-11 explained for Saudi organizations
The verified control text, what "periodically" really means, who must comply, ECC-2:2024 changes, and how CSCC, OTCC and SAMA relate to the base ECC.
CBB penetration testing requirements: the 2026 guide for Bahrain financial institutions
Testing twice a year in June and December, reports due 30 September and 31 March, two-year tester rotation, and the exact CBB Rulebook reference for banks, insurers, investment firms and payment providers.
OWASP Top 10 2021 → 2026: what actually changed in real engagements
Five years of OWASP data, mapped against hundreds of actual pen test findings. Broken Access Control still leads - but SSRF, injection, and insecure design have shifted in ways the updated list doesn't fully capture. Here's what we're actually finding in 2026.
Bypassing certificate pinning on iOS in 2026 - Frida, Objection, KeychainItem
Rootless jailbreaks, TrustKit, Network.framework, and custom pinning implementations. A full walkthrough of every technique we use in mobile pen tests today - and what to do when Objection doesn't work.
SSRF → IMDSv2 → STS: the cloud privilege-escalation chain we still see weekly
The full attack chain: SSRF entry point to AWS metadata service to IAM credential theft to STS AssumeRole privilege escalation. With real request examples, Azure/GCP equivalents, and remediation that actually works.
BOLA in REST APIs: why scanners miss the most common API1 finding
Object-level authorization failures are OWASP API Top 10 #1 for a reason - and automated scanners are structurally incapable of finding them. Here's how we test for BOLA manually, including GraphQL variants and compound key patterns.
PCI DSS v4.0 segmentation testing - what auditors now expect under 11.4.5
Requirement 11.4.5 tightened significantly in PCI DSS v4.0. QSAs now expect evidence that your segmentation controls actively prevent CDE-scope expansion. Here's what the test must cover, what auditors reject, and what a passing deliverable looks like.
Red team vs pen test: when each is wrong
The most expensive mistake in security procurement is buying the wrong engagement type. Pen tests that should have been red teams, red teams that should have been pen tests - and the questions that tell you which you actually need.
Clickjacking attacks: how invisible iframes hijack user clicks - and how to stop them
Clickjacking (UI redressing) requires no malware and no XSS - just a transparent iframe and an authenticated session. Attack anatomy, six real variants, X-Frame-Options vs CSP frame-ancestors, frame busting bypasses, and a six-point prevention checklist.
Web application pen testing tools for evolving attack surfaces
SPAs, GraphQL, edge functions, AI-powered apps - the attack surface has changed. So has the toolchain. A practitioner's guide to the proxy tools, recon utilities, API testing rigs, and specialized scanners we use in 2026 engagements.
The link between compliance and protection: how cybersecurity consulting bridges the gap
Compliance gives you a documented security posture. Protection gives you an actual one. Most organisations discover the gap between them during a breach. Here's how consulting bridges it - and what a mature programme looks like when both are working.
How regulatory compliance consulting services can help your organisation
SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, FTC Safeguards, CMMC - the regulatory landscape compounds every year. What compliance consulting actually delivers, common mistakes that derail audits, and how to right-size the engagement for your maturity level.
Koop × CyberFortify: when compliance gets smart and security gets strong
Koop's automated compliance intelligence combined with CyberFortify's manual offensive security practice. Why automated GRC and manual pen testing aren't alternatives - they're a force multiplier when used together.
Web Application Pentest Checklist - 2026 edition
156 test cases across pre-engagement, recon, authentication, authorization, injection, cryptography, API, business logic and reporting phases. Download the full PDF or browse the interactive version.
Ready for a real engagement?
Every post here is drawn from real pen test findings. When you're ready to test your own systems, our offensive security team will find what your scanners and automated tools miss.
Book a call