Blog

Insights & Blog

> tail -f /var/log/hedgehog/insights.log_

Our blog is full of practical cyber security insights and guidance, threat landscape updates, and lessons from the field. All of these have been written by our team of penetration testers and security researchers to help keep you up to date with what is going on in the world of cyber security and penetration testing. A lot of the articles we write about are drawn from real world engagements, anonymised of course.

Latest

213 articles published.

Penetration Testing 10 February 2026

What Questions to Ask Before Commissioning a Penetration Test

The quality of a penetration test is determined before the first packet is sent. The scoping conversation — the questions asked, the objectives defined, the assumptions identified — shapes every aspect of the engagement: what's tested, how deeply, by whom, and to what standard. Most organisations skip this conversation. They issue a purchase order for 'annual pen test,' provide a network range, and hope for meaningful results. This article provides the questions that transform a routine procurement into an engagement designed to produce genuine security improvement.

scoping pre-engagement questions
14 min read
Penetration Testing 3 February 2026

How to Choose a Penetration Testing Provider

Three quotes arrive for the annual pen test. The prices range from £4,000 to £18,000. The scope descriptions look similar. The proposal documents use the same terminology. The procurement team recommends the cheapest option — all three are 'pen tests,' so why pay more? This article explains why that logic is wrong, what separates a high-quality provider from a low-quality one, and how to evaluate methodology, reporting quality, and expertise so the organisation gets a pen test that actually improves security — rather than a compliance artefact that provides false assurance.

provider selection methodology reporting quality
15 min read
Penetration Testing 3 February 2026

When MFA Wasn't Really Multi-Factor

In the twenty-seventh instalment of From the Hacker Desk, Hedgehog Security demonstrates how an organisation's MFA deployment — believed to be comprehensive — was bypassed through session token theft, legacy protocol exceptions, conditional access policy gaps, and MFA fatigue. No passwords were cracked. No second factors were compromised. The article explains the difference between deploying MFA and achieving MFA resilience, and why the implementation details matter more than the checkbox.

penetration-testing mfa-bypass authentication-security
17 min read
Case Study 3 February 2026

Breaking Into the Smart Building Management System

In the twenty-sixth instalment of From the Hacker Desk, Hedgehog Security demonstrates how exposed BACnet services, default credentials on building controllers, and the convergence of IT and operational technology within a modern office tower allowed deep access to the building management system controlling HVAC, lighting, metering, and physical access. The article explores smart building security as an emerging discipline, the risks of environmental manipulation, and why the operational technology that keeps a building habitable deserves the same security scrutiny as the IT network it increasingly shares.

penetration-testing building-management bms-security
17 min read
Penetration Testing 27 January 2026

Why Penetration Testing Should Challenge Assumptions Rather Than Confirm Comfort

An organisation commissions a pen test and receives a report with four low findings and no critical or high issues. The CISO presents the results to the board: 'We passed.' Everyone is relieved. But the test was scoped to exclude the cloud environment, the rules of engagement prohibited social engineering, the testing window was three days for a 1,200-host network, and the provider was selected because they were the cheapest quote. The results are accurate — within the constraints. The comfort they provide is false — because the constraints were designed, consciously or not, to produce a comfortable result. This article argues that the purpose of a pen test is to challenge assumptions, not confirm them.

assumptions challenge comfort
14 min read
Incident Response 20 January 2026

The Role of Penetration Testing in Incident Preparedness

The pen test report describes a chain: phishing email delivers a payload, initial access on a workstation, LLMNR poisoning captures credentials, lateral movement to the file server, privilege escalation via a Kerberoastable service account, and Domain Admin in under three hours. Six months later, the real incident follows the same chain — almost step for step. This isn't coincidence. Pen testers and real attackers use the same techniques because they exploit the same weaknesses. The pen test report is the closest thing an organisation has to a preview of its next breach. This article explores how pen test findings mirror real breach pathways, how to use them to prepare for incidents, and why organisations that test regularly respond better when real attacks arrive.

incident response breach pathways incident preparedness
15 min read
Security Strategy 13 January 2026

How to Measure the Real Value of Penetration Testing Beyond Pass or Fail

Did we pass the pen test? It's the most common question leadership asks — and it's the wrong one. A penetration test isn't an exam. There's no pass mark, no certificate of invulnerability, no binary outcome that means the organisation is 'secure.' The real value of a pen test is measured in what changes afterwards: the vulnerabilities remediated, the detection gaps closed, the architectural improvements implemented, and the compounding risk reduction across successive engagements. This article explains how to measure that value — with metrics that demonstrate genuine security improvement rather than a reassuring binary.

metrics measurement value
15 min read
Threat Intelligence 6 January 2026

APT15: Vixen Panda — China's Diplomatic Espionage Group Targeting Foreign Ministries, Embassies, and Government Networks Worldwide

A comprehensive profile of APT15 (Vixen Panda, Ke3chang, Nickel, Nylon Typhoon, BackdoorDiplomacy), the Chinese state-sponsored threat group specialising in long-running diplomatic and government espionage operations since at least 2010. Covers Operation Ke3chang targeting European foreign ministries during the G20 summit, their custom malware arsenal including Ketrican, BS2005, RoyalDNS, Okrum, and Turian, Microsoft's seizure of 42 Nickel-associated domains in December 2021, BackdoorDiplomacy campaigns across Africa and the Middle East, Exchange Server exploitation, and their persistent focus on harvesting diplomatic intelligence from foreign affairs institutions worldwide.

apt15 vixen-panda ke3chang
18 min read
Threat Intelligence 6 January 2026

APT27: Emissary Panda — China's Strategic Web Compromise Specialists Targeting Defence and Energy

A comprehensive profile of APT27 (Emissary Panda, LuckyMouse, Iron Tiger, Bronze Union, TG-3390, Budworm, Earth Smilodon), the Chinese state-sponsored threat group conducting enterprise intrusion campaigns across defence, aerospace, energy, and government sectors since at least 2010. Covers their signature strategic web compromises (watering holes), custom tooling including HyperBro RAT, SysUpdate, and PlugX, exploitation of SharePoint and ProxyLogon vulnerabilities, shift to targeting the Middle East and Central Asia, cross-platform Linux malware development, use of legitimate cloud services for command and control, and the German BfV attribution and advisory that publicly linked the group to the People's Republic of China.

apt27 emissary-panda luckymouse
18 min read
Threat Intelligence 6 January 2026

APT3: Gothic Panda — China's Zero-Day Pioneers and the MSS-Linked Group That Changed Cyber Attribution Forever

A comprehensive profile of APT3 (Gothic Panda, Buckeye, UPS Team, TG-0110, Pirpi, Group 6), the Chinese state-sponsored threat group historically associated with MSS-directed cyber espionage and prolific zero-day exploitation. Covers their pioneering browser-based zero-day campaigns including Operation Clandestine Fox, Operation Double Tap, and Operation Clandestine Wolf, their links to Boyusec (Guangzhou Bo Yu Information Technology) and the Guangdong JSSD of China's Ministry of State Security, the landmark 2017 US DOJ indictments of Wu Yingzhuo, Dong Hao, and Xia Lei, their custom tooling arsenal including Pirpi RAT, RemoteCMD, and OSInfo, and their significance as one of the first Chinese APT groups publicly attributed to the MSS — a moment that reshaped how the world understands state-sponsored cyber operations.

apt3 gothic-panda buckeye
18 min read
Case Study 6 January 2026

Drone-to-Network Pivot — Landing Inside the Firewall

In the twenty-fifth instalment of From the Hacker Desk — and the fifth in our drone security series — Hedgehog Security demonstrates how a drone configured to automatically sync captured imagery to a corporate server became a network bridgehead. Once connected to the corporate Wi-Fi for file upload, the compromised drone inherited internal trust, bypassed perimeter controls, and provided a pivot point into internal systems. The article examines insecure device onboarding, poor NAC enforcement, and the segmentation failures that allowed an airborne device to become an inside threat.

penetration-testing uav-security network-pivot
17 min read
Penetration Testing 6 January 2026

Why Transparency in Penetration Testing Builds Trust Between Testers, Defenders, and Leadership

A penetration test involves a third party attempting to compromise your organisation's systems. That dynamic — outsiders probing your defences, finding your weaknesses, documenting your failures — can either build trust or destroy it. The difference is transparency: in scoping, in communication during testing, in honest reporting, and in the debrief. This article explores how transparency at every stage transforms a pen test from an adversarial exercise into a partnership that makes the organisation genuinely safer.

transparency trust communication
14 min read
Threat Intelligence 5 January 2026

APT10: Stone Panda — China's Cloud Hopper Group and the Architects of Global MSP Supply Chain Compromise

A comprehensive profile of APT10 (Stone Panda, MenuPass, Red Apollo, CVNX, POTASSIUM, Cicada, ChessMaster, Cloud Hopper), the Chinese state-sponsored threat group responsible for Operation Cloud Hopper — the unprecedented campaign targeting managed service providers to infiltrate their downstream clients worldwide. Covers their MSS Tianjin bureau affiliation, the 2018 US DOJ indictments of Zhu Hua and Zhang Shilong, custom malware including PlugX, Quasar RAT, ChChes, LODEINFO, and NOOPDOOR, Japan-focused A41APT operations, Operation Soft Cell targeting telecoms, and their evolution from one of China's longest-running APT groups into a focused sectoral threat.

apt10 stone-panda menupass
18 min read
Threat Intelligence 5 January 2026

APT41: Double Dragon — China's Dual-Mandate Threat Group Blending State Espionage with Financially Motivated Cybercrime

A comprehensive profile of APT41 (Double Dragon, Brass Typhoon, BARIUM, Wicked Panda, Winnti), the Chinese state-sponsored threat group uniquely operating across both espionage and financially motivated cybercrime. Covers their unprecedented dual mandate, devastating supply chain attacks including ShadowPad and CCleaner, links to Chengdu 404 Network Technology, the 2020 US DOJ indictments, COVID-19 pandemic targeting, custom malware arsenal including KEYPLUG and DUSTPAN, and their position as perhaps the most versatile and dangerous APT group in the modern threat landscape.

apt41 double-dragon brass-typhoon
18 min read
Threat Intelligence 5 January 2026

Mustang Panda: RedDelta — China's Relentless Diplomatic Espionage Group Targeting Geopolitical Fault Lines

A comprehensive profile of Mustang Panda (RedDelta, TA416, Bronze President, Earth Preta, Stately Taurus, TEMP.Hex, Camaro Dragon, LuminousMoth), the Chinese state-sponsored threat group conducting long-running diplomatic and geopolitical espionage operations. Covers their heavy reliance on USB propagation and removable media for initial access, custom malware arsenal including PlugX (Korplug), TONEINS, TONESHELL, and DOPLUGS, spear-phishing campaigns using geopolitical lures targeting EU institutions, Southeast Asian governments, Myanmar political entities, Vatican and Catholic organisations, and European diplomatic targets in the wake of the Russia-Ukraine conflict. Examines their prolific use of DLL side-loading, evolving tradecraft, and position as one of China's most active and geographically far-reaching espionage operators.

mustang-panda reddelta ta416
18 min read
Threat Intelligence 5 January 2026

Salt Typhoon: The Telecom Phantom — China's Deep Penetration of Global Telecommunications Backbone Infrastructure

A comprehensive profile of Salt Typhoon (GhostEmperor, FamousSparrow, Earth Estries, UNC2286), the Chinese state-sponsored espionage cluster responsible for one of the most significant intelligence compromises in US history. Covers their systematic infiltration of major telecommunications providers including AT&T, Verizon, T-Mobile, and Lumen Technologies, compromise of lawful intercept (CALEA) wiretap systems, access to call detail records of millions of Americans, exploitation of Cisco IOS XE vulnerabilities, deep network infrastructure compromise of core routers and switches, FBI/CISA emergency warnings, potential access to classified FISA court surveillance orders, and the devastating national security implications of a foreign adversary embedded inside the communications backbone of the United States.

salt-typhoon china telecommunications
20 min read
Threat Intelligence 5 January 2026

Volt Typhoon: Silent Presence — China's Pre-Positioning Campaign in Western Critical Infrastructure Using Living-off-the-Land Techniques and Stealth Persistence

A comprehensive profile of Volt Typhoon (Vanguard Panda, Bronze Silhouette, DEV-0391, Insidious Taurus, UNC3236), the Chinese state-sponsored threat group pre-positioning in United States critical infrastructure using living-off-the-land techniques. Covers their near-total avoidance of custom malware, abuse of legitimate system tools including wmic, ntdsutil, netsh, PowerShell, and certutil, exploitation of SOHO routers as operational relay boxes, the KV Botnet C2 infrastructure, targeting of energy, water, telecommunications, and transportation sectors, the May 2023 Microsoft and Five Eyes disclosure, CISA/NSA/FBI joint advisories, compromises of Fortinet, Ivanti, NETGEAR, and Cisco devices, and their assessed objective of building disruption capability for potential use during a geopolitical conflict over Taiwan.

volt-typhoon china critical-infrastructure
20 min read
Security Strategy 30 December 2025

How Pen Test Reports Can Prioritise Security Investment Intelligently

Most security budgets are built reactively — a breach at a competitor triggers MFA investment, a ransomware headline accelerates endpoint detection procurement, an auditor's finding forces a logging upgrade. The pen test report sits in a shared drive, referenced occasionally but rarely used as the investment prioritisation tool it should be. This article explains how to use pen test findings — particularly attack chains, effort-to-impact ratios, and longitudinal data — to make evidence-based security investment decisions that address demonstrated risk rather than perceived threat.

security investment budgeting ROI
14 min read
Security Architecture 23 December 2025

The Relationship Between Penetration Testing and Secure Architecture Design

Most pen test findings are treated as configuration issues — fix the setting, close the finding. But the most valuable findings are the ones that reveal architectural weaknesses: the flat network that enables lateral movement, the trust model that grants excessive access, the authentication architecture that can't enforce MFA where it matters. These findings don't get fixed by changing a GPO. They get fixed by changing the architecture. This article explores the feedback loop between penetration testing and secure design — and why organisations that feed test results back into their architecture produce systems that are fundamentally harder to compromise.

security architecture secure design feedback loop
15 min read
Penetration Testing 16 December 2025

Why Penetration Testing Should Evolve as the Business Evolves

The business migrated to AWS. The company acquired a competitor. A new customer portal launched. The workforce shifted to hybrid. The supply chain added three new SaaS providers. And the penetration test? Same scope as last year. Same internal infrastructure test. Same methodology. Same five-day window. The business evolved. The testing didn't. This article explains why static pen testing produces diminishing returns — and how to build a programme that adapts to the business, testing what matters now rather than what mattered two years ago.

evolving scope business change attack surface
14 min read
Compliance & Regulation 9 December 2025

DORA Requirements for Penetration Testing: An In-Depth Guide

The Digital Operational Resilience Act (DORA) has made penetration testing a legal obligation for financial entities operating in the EU. Not a recommendation. Not a best practice. A regulation — with two distinct tiers of testing requirements, specific tester qualifications, mandatory purple teaming, and supervisory oversight. This in-depth guide covers every aspect of DORA's penetration testing requirements: the general resilience testing programme under Articles 24–25, the advanced Threat-Led Penetration Testing (TLPT) framework under Articles 26–27, and what financial entities need to do to comply.

DORA TLPT TIBER-EU
18 min read
Case Study 2 December 2025

Cracking the Drone Controller — When Firmware Becomes the Weak Link

In the twenty-fourth and final instalment of the drone series within From the Hacker Desk, Hedgehog Security shifts focus from the aircraft to the handheld controller. Through firmware extraction and reverse engineering, we identified hard-coded credentials, an unencrypted firmware update channel, and authentication tokens that could be used to impersonate the controller to the manufacturer's cloud infrastructure. The article details firmware extraction methodology, update integrity validation failures, and the supply chain risks inherent in consumer and commercial UAV ecosystems.

penetration-testing firmware-analysis reverse-engineering
17 min read
Risk & Governance 2 December 2025

How Penetration Testing Fits into a Broader Risk Management and Governance Framework

A penetration test produces findings. Risk management determines what to do about them. Governance ensures the decisions are made, tracked, and reported. Without this framework, pen test findings sit in a report. Within it, they become entries in the risk register, inputs to the risk treatment plan, evidence for the audit committee, and data points in the board's risk reporting. Here's how penetration testing connects to — and strengthens — the governance structure that turns identified risk into managed risk.

risk management governance risk register
15 min read
Compliance & Certification 25 November 2025

How Penetration Testing Supports and Elevates Cyber Essentials Plus Certification

Cyber Essentials Plus certifies that an organisation meets a baseline of technical controls. A penetration test demonstrates what happens when a motivated attacker encounters those controls in practice. Together, they provide something neither achieves alone: verified baseline security with evidence of real-world resilience. Here's how pen testing supports CE+ certification, reveals the gaps it doesn't cover, and elevates the organisation's security posture beyond the certification baseline.

Cyber Essentials Cyber Essentials Plus compliance
15 min read
Penetration Testing 18 November 2025

What a Mature Penetration Testing Programme Looks Like Over Multiple Years

A penetration test is an event. A penetration testing programme is a strategy. The difference determines whether the organisation gets a snapshot once a year or a compounding improvement trajectory that measurably reduces risk over time. This article maps the journey from first engagement through multi-year maturity — showing how scope evolves, what metrics matter, how testing integrates with red and purple teaming, and what the board should see at each stage.

programme maturity multi-year testing security strategy
16 min read
Penetration Testing 11 November 2025

Remediation Validation and Retesting: Closing the Loop on Penetration Testing

A finding marked 'remediated' in a tracker is not the same as a finding that's been verified as fixed. Without validation, the remediation programme is an act of faith — the GPO might be on the wrong OU, the firewall rule might have an exception, the detection rule might miss the variant. Retesting closes the loop: it confirms that fixes work, demonstrates measurable improvement, and transforms the pen test from a one-time event into a continuous improvement cycle.

remediation retesting validation
15 min read
Technical Deep Dive 4 November 2025

Custom Payloads and Evasion: A Deep Dive into Metasploit Payload Crafting

The exploit lands. The payload deploys. Windows Defender quarantines it in 200 milliseconds. The shell never opens. Modern endpoint security has made default Metasploit payloads largely ineffective against up-to-date systems — and that's precisely why understanding custom payload creation, encoding, encryption, and evasion is essential for any penetration tester working against real-world environments. This deep dive covers the full payload crafting pipeline: from msfvenom basics through multi-layer encoding, custom templates, and the techniques that actually work against modern EDR.

metasploit msfvenom payloads
18 min read
Case Study 4 November 2025

Exploiting GPS Spoofing Against a Security Patrol Drone

In the twenty-third instalment of From the Hacker Desk, Hedgehog Security demonstrates how GPS spoofing techniques could alter the flight path of an autonomous security patrol drone without physical or network access to the aircraft. The article explains the mechanics of civilian GNSS signal manipulation, the limitations of satellite navigation without integrity checking, and why organisations that rely on autonomous UAV patrols for perimeter security must understand the exploitable assumptions built into civilian GPS.

penetration-testing gps-spoofing drone-security
17 min read
Technical Deep Dive 28 October 2025

Metasploit: A Deep Dive into the Exploitation Framework

Metasploit is the framework that turns a vulnerability into a compromise — bridging the gap between 'this system is vulnerable' and 'here's proof of what an attacker can do with it.' This deep dive covers the architecture, the module system, Meterpreter, payload selection, database integration, post-exploitation, and how professional penetration testers use Metasploit as part of a disciplined engagement — not a point-and-click hacking tool.

metasploit exploitation meterpreter
18 min read
Insights & Strategy 21 October 2025

"No Critical Findings" Does Not Mean Secure

A comprehensive examination of why a clean penetration test report can be the most dangerous document an organisation receives. Covering the gap between what 'no critical findings' actually means and how boards interpret it, the hidden risk in finding chains and attack paths, the structural limits of point-in-time testing, real-world examples where clean reports preceded catastrophic breaches, and practical guidance for organisations, CISOs, and boards on interpreting pen test results without creating false confidence.

penetration-testing risk-management false-confidence
22 min read
Penetration Testing 21 October 2025

"No Critical Findings" Does Not Mean Secure

The pen test report comes back with zero critical findings. The board is reassured. The CISO defers the MFA project. The organisation moves on — secure in the knowledge that a professional tester couldn't find anything critical. Except 'no critical findings' doesn't mean the organisation is secure. It means the tester didn't find critical-severity vulnerabilities within this scope, timeframe, and methodology. The difference between those two statements is where residual risk lives.

residual risk risk communication false confidence
15 min read
Penetration Testing 14 October 2025

Common Mistakes Organisations Make When Interpreting Pen Test Reports

The pen test report is excellent. The testing was thorough. The findings are well-evidenced and the remediation is specific. And then the organisation misinterprets it — fixating on the wrong findings, drawing false conclusions from the severity scores, treating the report as a verdict rather than a snapshot, and directing remediation effort at the loudest numbers instead of the greatest risk. Here are the mistakes we see most often, and how to avoid them.

reporting interpretation remediation
15 min read
Case Study 7 October 2025

Turning a Corporate Drone into an Airborne Reconnaissance Platform

In the twenty-second instalment of From the Hacker Desk, Hedgehog Security examines how a corporate drone deployed for marketing footage had inadvertently become a repository of sensitive intelligence — stored video revealing site layouts and security configurations, GPS logs mapping months of corporate activity, cached Wi-Fi credentials for every network the device had connected to, and metadata exposing client sites and personnel. The article discusses how UAVs passively collect and retain data far beyond their intended purpose, and how that accumulated intelligence can be weaponised by an attacker who gains access to the device.

penetration-testing uav-security data-exposure
16 min read
Penetration Testing 7 October 2025

How Pen Test Reports Support Regulatory, Legal, and Insurance Discussions

The penetration test finishes in two weeks. The report serves the organisation for years — reviewed by auditors during certification, submitted to insurers during renewal, disclosed to regulators during inquiries, and produced as evidence if a breach occurs. A report written only for the IT team misses the majority of its audience. Here's how pen test reports function as regulatory, legal, and insurance artefacts — and how to ensure yours is an asset rather than a liability.

compliance regulation cyber insurance
16 min read
Penetration Testing 30 September 2025

Executive Summaries: The Two Pages That Fund or Fail Remediation

The executive summary is the only section of a penetration test report that the people who control the budget will read. If it communicates business risk in language they understand, remediation gets funded. If it communicates technical findings in language they don't, the report gets filed. Here's how to write the two pages that determine whether anything changes.

executive summary reporting board communication
14 min read
Technical Deep Dive 23 September 2025

Netcat: A Deep Dive into the Swiss Army Knife of Networking

Netcat has been called the Swiss Army knife of networking since 1995 — and for good reason. It reads and writes data across network connections using TCP or UDP, and that deceptively simple capability underpins port scanning, banner grabbing, file transfer, bind and reverse shells, pivoting, and ad-hoc network debugging. This deep dive covers every mode, every variant, and how penetration testers use Netcat as a building block for techniques that more sophisticated tools are built upon.

netcat ncat networking
17 min read
Penetration Testing 16 September 2025

Evidence, Screenshots, and Reproduction Steps: Building Trust in Pen Test Findings

A finding without evidence is an opinion. A finding with a screenshot is a claim. A finding with reproduction steps, timestamped evidence, and a verification method is a fact that drives action. Here's why evidence quality determines whether findings get fixed, get disputed, or get ignored — and what good evidence actually looks like.

reporting evidence screenshots
15 min read
Penetration Testing 9 September 2025

Writing Findings That Teams Can Actually Remediate

The most common reason penetration test findings don't get fixed isn't disagreement with the severity, lack of budget, or technical impossibility. It's that the remediation guidance is too vague for the team receiving it to implement without further research. Here's how to write findings that development, infrastructure, and security teams can realistically act on — and why specificity is the difference between a finding that gets fixed and one that gets backlogged.

reporting remediation actionable findings
16 min read
Case Study 2 September 2025

Hijacking the Drone Above the Construction Site

In the twenty-first instalment of From the Hacker Desk, Hedgehog Security examines a security assessment of commercial UAVs used for aerial surveying at a construction firm. Testing revealed unsecured telemetry channels, weak controller-aircraft pairing mechanisms, exposed ground station software, and the potential for command injection, surveying data manipulation, and controlled denial of service. The article explores the emerging attack surface of commercial drone operations and why organisations deploying UAVs must treat them as networked computing platforms, not flying cameras.

penetration-testing uav-security drone-hacking
17 min read
Penetration Testing 2 September 2025

The Real World Risk Score: Why Context Beats CVSS

CVSS tells you how bad a vulnerability is in theory. It doesn't tell you how bad it is in your environment, with your data, behind your controls, in the context of the attack chains your pen tester actually demonstrated. That's why we use the Real World Risk Score — a contextual severity model that rates findings by what they actually mean for your organisation, not what they'd mean in a vacuum.

CVSS risk scoring real world risk
15 min read
Penetration Testing 26 August 2025

Vulnerability List vs Narrative Report: Why Context Is Everything

A vulnerability list tells you what's wrong. A narrative report tells you what happens when things go wrong — in what order, through which path, with what consequences, and what single change would have stopped it. One is a spreadsheet. The other is understanding. Here's why the difference matters more than most organisations realise.

reporting narrative risk context
15 min read
Penetration Testing 19 August 2025

Translating Technical Findings into Business Risk

A pen test report that says 'Kerberoasting achieved Domain Admin via svc_backup' communicates everything to a security engineer and nothing to a board member. The same finding expressed as 'an attacker on our network can access every customer record, every financial document, and every email in the organisation within four hours — and our security systems won't detect it' communicates everything to a board member. Same finding. Different language. Different outcome.

business risk executive reporting board communication
15 min read
Penetration Testing 12 August 2025

The Report Is the Deliverable, Not the Test

The penetration test has no value in isolation. The tester's knowledge evaporates when the engagement ends. The compromised systems are restored. The shells are closed. The only thing that persists — the only artefact that drives remediation, informs the board, satisfies the auditor, and changes the organisation's security posture — is the report. The report isn't a summary of the work. It IS the work.

reporting pen test deliverables ROI
14 min read
Case Study 5 August 2025

From Guest Wi-Fi to Sensitive Data

In the twentieth instalment of From the Hacker Desk, Hedgehog Security traces a path from a guest wireless network — intended to provide internet-only access for visitors — to sensitive corporate data, through a chain of misconfigured firewall rules, a shared print services VLAN, and an overlooked network bridge. The article dissects how assumptions about guest isolation frequently collapse under scrutiny and provides a methodology for validating that guest networks are genuinely isolated.

penetration-testing guest-wifi network-segmentation
16 min read
Penetration Testing 5 August 2025

What a Good Penetration Test Report Looks Like

The penetration test is only as valuable as the report it produces. A technically brilliant engagement that delivers an unreadable, jargon-dense, 200-page PDF has failed its intended audience. Here's what a good report looks like, why most reports fall short, and how to tell whether your provider's deliverable is worth the paper — or the screen — it's written on.

reporting pen test deliverables executive summary
16 min read
Technical Deep Dive 29 July 2025

Fun and Frustrations with Pentesting AI Engines and Guardrails

What happens when you point a penetration tester at an LLM-powered application? Prompt injection, guardrail bypass, data leakage through context windows, and a testing methodology that breaks every assumption traditional pen testing was built on. Here's what we've learned — the fun bits, the frustrating bits, and why AI security testing is a discipline that doesn't quite exist yet.

AI security LLM prompt injection
16 min read
Penetration Testing 22 July 2025

Why Detection Gaps Are More Valuable Than Vulnerabilities

A penetration test that reports 'Domain Admin achieved via Kerberoasting' gives you a vulnerability to fix. A penetration test that reports 'Domain Admin achieved via Kerberoasting — and your SOC detected none of the seven attacker actions across three hours' gives you a detection engineering programme. The second finding is worth more. Here's why.

detection engineering SOC SIEM
16 min read
Technical Deep Dive 15 July 2025

Nmap: A Deep Dive for Vulnerability Scanning and Penetration Testing

Nmap is the most widely used network scanning tool in the world — and most people use about 10% of its capability. This deep dive covers everything from basic host discovery through advanced NSE scripting, service enumeration, OS fingerprinting, firewall evasion, and how professional penetration testers use Nmap as the foundation of every infrastructure engagement.

nmap network scanning vulnerability scanning
18 min read
Penetration Testing 8 July 2025

Penetration Testing and Defensive Security: Complement, Not Competition

Penetration testing doesn't replace a SOC, EDR, or detection capability — and a mature defensive stack doesn't eliminate the need for penetration testing. They answer fundamentally different questions. Here's how they complement each other, where each exposes the other's blind spots, and why the organisations with the strongest security posture invest in both.

SOC EDR detection
16 min read
Case Study 1 July 2025

Cracking 60% of Passwords in a Single Afternoon

In the nineteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how ARP poisoning, LLMNR/NBT-NS abuse, and NetNTLMv2 relay and capture — combined with offline hash cracking — yielded sixty per cent of an organisation's domain passwords in a single afternoon. The article examines why traditional password policies produce predictably weak passwords, why compliance-driven complexity rules create an illusion of security, and how modern passphrase strategies and technical controls can fundamentally change the economics of credential attacks.

penetration-testing password-cracking credential-security
17 min read
Penetration Testing 1 July 2025

The Human Element of Penetration Testing

The most hardened perimeter, the most carefully configured cloud environment, and the most thoroughly tested application all share the same weakness: the people who use them. Here's how penetration testing exposes the human assumptions that attackers routinely exploit — and why technology alone will never be enough.

social engineering phishing human factors
17 min read
Penetration Testing 24 June 2025

Testing SaaS Platforms and the Shared Responsibility Model

You can't port-scan Salesforce. You can't run Nmap against Microsoft 365. Modern SaaS penetration testing requires understanding shared responsibility models, tenant isolation boundaries, and configuration-level risk — not brute-force exploitation of infrastructure you don't own.

SaaS security shared responsibility tenant isolation
15 min read
Technical Deep Dive 17 June 2025

NetNTLMv2 Hash Cracking and the Case Against Legacy Authentication

NetNTLMv2 hash capture and cracking is one of the most reliable attack techniques in internal penetration testing — and it works because enterprises continue to run authentication protocols designed in an era before the threats they now face existed. Here's how the attack works, why it's so effective, and what modern authentication should look like.

NTLM NetNTLMv2 authentication
16 min read
Penetration Testing 3 June 2025

Cloud Penetration Testing

Cloud penetration testing isn't traditional infrastructure testing relocated to someone else's data centre. The attack surface is different, the rules are different, the methodology is different, and the misconceptions are everywhere. Here's what cloud testing actually involves — and what most organisations get wrong.

cloud security AWS Azure
15 min read
Case Study 3 June 2025

Turning a CCTV System into an Intelligence Hub

In the eighteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a CCTV management interface — accessible from the corporate network with default credentials — became a reconnaissance goldmine, revealing network topology, stored credentials for adjacent systems, and administrative access to physical security infrastructure. The article explores why surveillance systems are consistently underestimated as attack surfaces and how their privileged network position makes them ideal pivot points.

penetration-testing cctv-security physical-security
16 min read
Penetration Testing 3 June 2025

Privilege Escalation in Penetration Testing

Privilege escalation is the phase that transforms a minor foothold into a catastrophic compromise. Here's how it works across Windows, Linux, Active Directory, cloud, and web applications — and why it matters more than any single vulnerability in the report.

privilege escalation penetration testing Active Directory
15 min read
Penetration Testing 27 May 2025

Identity, Authentication, and Access Control in Penetration Testing

Broken access control is the number one vulnerability class in the OWASP Top 10. Authentication flaws enable the majority of real-world breaches. And automated scanners miss almost all of them. Here's what penetration testing reveals about the identity layer that no tool can assess.

access control authentication identity
14 min read
Penetration Testing 20 May 2025

Internal vs External Penetration Testing

External tests simulate an attacker trying to get in. Internal tests simulate what happens after they succeed. Here's how they differ, what each reveals about your security posture, and why the internal test almost always produces the findings that keep CISOs awake at night.

internal testing external testing lateral movement
14 min read
Penetration Testing 13 May 2025

Responsible Proof of Concept in Penetration Testing

Proof-of-concept exploitation is what separates a credible penetration test from a theoretical exercise. But PoC that goes too far damages trust, and PoC that doesn't go far enough gets ignored. Here's how to get the balance right.

proof of concept penetration testing responsible disclosure
13 min read
Case Study 6 May 2025

Escalating Through Misconfigured API Endpoints

In the seventeenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a modern web application with no traditional injection vulnerabilities was compromised through API logic flaws — broken object-level authorisation, mass assignment, and insecure direct object references. The article examines why the evolution from monolithic web applications to API-driven architectures has shifted the attack surface from code injection to authorisation logic, and why testing must evolve accordingly.

penetration-testing api-security web-application
16 min read
Penetration Testing 6 May 2025

What Exploitation Really Means in a Penetration Test

Exploitation in a professional pen test isn't about breaking things — it's about proving that an attacker could. Here's how testers balance realism with safety, why proof of impact changes the remediation conversation, and what responsible exploitation looks like in practice.

penetration testing exploitation proof of concept
14 min read
Penetration Testing 29 April 2025

Chaining Low-Risk Findings Into High-Impact Compromise

Individual vulnerabilities rarely tell the full story. The most devastating breaches are built from chains of low- and medium-severity findings that, combined, deliver a result far worse than any single vulnerability alone.

vulnerability chaining penetration testing risk assessment
14 min read
Penetration Testing 22 April 2025

Penetration Testing Methodology Walkthrough

A plain-English, step-by-step walkthrough of what actually happens during a professional penetration test — from the first scoping conversation through to the final retest — so you know exactly what you're commissioning and what to expect at every stage.

penetration testing methodology process
15 min read
Penetration Testing 15 April 2025

Why Automated Tools Are Not Enough

Automated vulnerability scanners are fast, consistent, and essential — but they are fundamentally incapable of finding the vulnerabilities that lead to real breaches. Here's what they miss, why they miss it, and what skilled human testers bring that no tool can replicate.

penetration testing vulnerability scanning automation
14 min read
Penetration Testing 8 April 2025

Attack Surface Mapping

How mapping the full attack surface — not just the assets you know about — informs test depth, prioritisation, and realistic exploitation paths. And why most organisations are testing less than half of what an attacker can see.

attack surface penetration testing asset discovery
13 min read
Case Study 1 April 2025

The USB That Opened the Door

In the sixteenth instalment of From the Hacker Desk, Hedgehog Security recounts a controlled USB drop exercise that demonstrated how human curiosity consistently overrides security policy. The article analyses the technical and human dimensions of USB-based attacks, evaluates the effectiveness of endpoint execution policies and device control mechanisms, and examines what the results reveal about the gap between security awareness training and actual behaviour under real-world conditions.

penetration-testing social-engineering usb-security
16 min read
Penetration Testing 1 April 2025

Reconnaissance and OSINT in Penetration Testing

Why modern attackers rarely begin with scanning tools — and how open-source intelligence gathering shapes every phase of a real attack, from target selection through to objective completion.

reconnaissance OSINT penetration testing
14 min read
Penetration Testing 25 March 2025

How We Model Real-World Threat Scenarios

How we design penetration tests around genuine attacker behaviour rather than generic checklists — using threat intelligence, MITRE ATT&CK, and scenario-based modelling to ensure every engagement reflects the threats your organisation actually faces.

threat modelling MITRE ATT&CK red team
14 min read
Penetration Testing 18 March 2025

Why Bad Scoping Is Worse Than No Testing

A penetration test with incorrect scoping doesn't just waste money — it actively makes you less safe by creating false confidence. Here's how scoping goes wrong and what to do about it.

penetration testing scoping risk management
12 min read
Penetration Testing 11 March 2025

What Happens Before a Penetration Test

The most important phase of a penetration test happens before any tool is launched. Scoping, rules of engagement, and getting your assumptions right determine whether the test delivers genuine insight or just generates noise.

penetration testing scoping rules of engagement
13 min read
Security Strategy 10 March 2025

Why the Ultimate Goal of Penetration Testing Is Not to Find Flaws

Fifty-seven articles in this series have explored the techniques, the reports, the frameworks, the metrics, and the strategy of penetration testing. Each article focused on a specific aspect — from writing remediable findings to building multi-year programmes, from DORA compliance to choosing providers. But every article pointed toward the same truth: the purpose of a pen test is not to find vulnerabilities. Vulnerabilities are the means. The purpose is to enable better decisions at every level of the organisation — from the engineer who fixes the GPO to the board member who approves the investment. This final article brings the series together around that central idea.

decision-making resilience confidence
14 min read
Penetration Testing 4 March 2025

Common Penetration Testing Types Explained

A plain-English guide to the most common types of penetration test — external, internal, web application, mobile, cloud, wireless, and social engineering — what each one covers, what it finds, and when you need it.

penetration testing web application testing social engineering
14 min read
Case Study 4 March 2025

Leveraging Default Credentials in Industrial Control Systems

In the fifteenth instalment of From the Hacker Desk, Hedgehog Security examines an engagement where an operational technology network retained manufacturer-default credentials on programmable logic controllers, human-machine interfaces, and engineering workstations. The article explores the unique challenges of testing ICS environments, the consequences of configuration inertia, and why the convergence of IT and OT networks demands a fundamentally different approach to security assessment.

penetration-testing ics-security ot-security
17 min read
Penetration Testing 25 February 2025

How Attackers Actually Think

Understanding the attacker mindset — how real adversaries approach a target, why they succeed, and how that understanding shapes effective penetration testing and smarter defence.

attacker mindset kill chain penetration testing
12 min read
Penetration Testing 18 February 2025

Compliance-Driven vs Threat-Led Penetration Testing

The difference between testing because a standard says you must and testing because you genuinely want to understand your risk — and why confusing the two leads to poor security decisions.

penetration testing compliance threat-led testing
11 min read
Penetration Testing 11 February 2025

Penetration Testing Is a Business Risk Exercise, Not Just a Technical One

Why the most valuable outcome of a penetration test isn't a list of CVEs — it's a clear understanding of what an attacker could do to your business, and what that would cost you.

penetration testing business risk risk management
9 min read
Case Study 4 February 2025

Breaking Into Wi-Fi from the Car Park

In the fourteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how corporate wireless networks were compromised from outside the building perimeter — from a vehicle in the car park. The article details modern wireless attack methodology including PMKID capture, WPA2 PSK cracking, evil twin attacks, and the exploitation of legacy wireless configurations, and explains the defensive controls that organisations frequently overlook.

penetration-testing wireless-security wifi-hacking
16 min read
Penetration Testing 4 February 2025

An Introduction to Penetration Testing

What penetration testing is, what it is not, and why it exists as a discipline distinct from vulnerability scanning. A clear, jargon-light guide for decision-makers and technical teams alike.

penetration testing vulnerability scanning security fundamentals
10 min read
Attack Techniques 28 January 2025

Understanding Pass-the-Hash: How Attackers Exploit Password Vulnerabilities in Windows Environments

A comprehensive technical breakdown of the Pass-the-Hash attack technique. Covers how NTLM authentication works, why hashes are equivalent to passwords, how attackers extract and relay credentials, and what organisations must do to detect, mitigate, and prevent lateral movement through hash-based authentication abuse.

pass-the-hash ntlm lateral-movement
16 min read
Penetration Testing 24 January 2025

Why Penetration Testing Remains Relevant Despite Advances in Automated Security Tooling and AI-Driven Detection

The sales pitch is compelling: deploy the AI-powered vulnerability scanner, enable the machine learning-driven EDR, activate the automated penetration testing platform, and eliminate the need for expensive human testers. The tools are impressive. The dashboards are reassuring. The coverage metrics are comprehensive. And the argument follows logically: if automation can scan every port, test every configuration, and detect every known vulnerability — why pay a human to do it? This article explains why — and why the organisations that replace human pen testing with automated tooling are making a decision they may not understand until the breach that automation didn't predict.

automation AI machine learning
14 min read
Threat Intelligence 21 January 2025

APT39: A Closer Look at Iran's Cyber Espionage Operation Targeting Travel and Telecommunications

An in-depth examination of APT39 (Chafer), an Iranian state-sponsored threat group focused on surveillance and tracking of individuals through compromise of travel, telecommunications, and hospitality organisations. Covers attribution, tactics, techniques, infrastructure, detection opportunities, and what their operations mean for organisations in targeted sectors.

apt39 chafer iran
15 min read
Security Strategy 17 January 2025

How Penetration Testing Differs from Red Teaming, and When Each Is Appropriate

The terms are used interchangeably — often by providers who offer both, and sometimes by providers who offer neither. A client asks for a red team engagement and receives a pen test with a different label. A CISO requests a pen test and is sold a red team exercise at three times the cost. The confusion isn't academic — it leads to organisations buying the wrong assessment for their maturity level, their objectives, and their budget. This article explains the fundamental differences between penetration testing and red teaming, when each approach produces the most value, and how purple teaming completes the picture.

red teaming purple teaming penetration testing
15 min read
Threat Intelligence 14 January 2025

TeamViewer Hack — What You Need to Know and What to Do

A detailed analysis of the June 2024 TeamViewer corporate network breach attributed to APT29 (Midnight Blizzard). Covers what happened, how the attack was executed through a compromised employee account, what data was accessed, the transparency controversy, and what organisations using TeamViewer should do to protect themselves.

teamviewer apt29 midnight-blizzard
14 min read
Threat Intelligence 7 January 2025

APT33: The Aerospace Stalker — Iran's IRGC-Linked Cyber Espionage Group Targeting Defence and Energy

An in-depth profile of APT33 (Elfin, Peach Sandstorm, Refined Kitten), an Iranian state-sponsored threat group linked to the Islamic Revolutionary Guard Corps. Covers their decade-long targeting of aerospace, defence, and energy sectors, evolving tradecraft from spear-phishing to cloud-based operations, custom malware including Tickler and FalseFont, and what organisations in targeted sectors must do to defend against persistent nation-state espionage.

apt33 elfin peach-sandstorm
16 min read
Case Study 7 January 2025

When Backup Systems Became the Attack Vector

In the thirteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how backup appliances — implicitly trusted and rarely scrutinised — provided a direct path to an organisation's most sensitive data. Outdated firmware, exposed management interfaces, and default credentials on the backup infrastructure yielded access to full system images, database dumps, and Active Directory backups. The article argues that resilience systems must be treated as high-value targets deserving the same security rigour as the production systems they protect.

penetration-testing backup-security data-protection
16 min read
Vulnerability Analysis 1 January 2025

CVE-2024-21410: Critical Microsoft Exchange NTLM Relay Vulnerability — What Happened, Why It Matters, and What to Do

A detailed technical analysis of CVE-2024-21410, the critical CVSS 9.8 privilege escalation vulnerability in Microsoft Exchange Server that was actively exploited as a zero-day. Covers the NTLM relay attack mechanism, affected systems, exploitation in the wild, remediation through Extended Protection for Authentication, and why this vulnerability exemplifies the systemic risk of NTLM in modern enterprise environments.

cve-2024-21410 exchange-server ntlm-relay
14 min read
Defensive Security 25 December 2024

What Are Tarpits? Slowing Down Attackers by Wasting Their Time

A technical explanation of network tarpits and how they are used as a defensive technique to slow down port scanners, brute-force tools, spam bots, and automated attack infrastructure. Covers how tarpits work at the TCP level, common implementations including LaBrea, Endlessh, and modern HTTP tarpits, their role in a layered defence strategy, and the practical considerations for deployment in production environments.

tarpits defensive-security network-defence
13 min read
Threat Intelligence 18 December 2024

APT42: Iran's Social Engineering Specialists — From Journalist Impersonation to Election Interference

An in-depth profile of APT42 (Charming Kitten, Mint Sandstorm, TA453), the IRGC Intelligence Organization's cyber espionage group specialising in surveillance of dissidents, journalists, academics, and political figures. Covers their world-class social engineering tradecraft, credential harvesting operations, mobile surveillance capabilities, the 2024 US presidential election hack, and what makes this group uniquely dangerous to individuals rather than infrastructure.

apt42 charming-kitten mint-sandstorm
16 min read
Threat Intelligence 11 December 2024

APT12: The PRC's Cyber Operative — From the New York Times Hack to a Decade of Espionage Against East Asia

An in-depth profile of APT12 (Numbered Panda, IXESHE, DynCalc, Hexagon Typhoon), a Chinese People's Liberation Army-linked cyber espionage group targeting media organisations, governments, and high-technology companies across East Asia. Covers the 2012 New York Times breach, the group's custom malware families, their distinctive ability to rapidly evolve after public exposure, and why their sustained focus on Taiwan and Japan reflects the PRC's broader strategic objectives.

apt12 numbered-panda china
15 min read
Threat Intelligence 4 December 2024

APT35: Iran's Long-Running Espionage Machine — From Fake Journalists to ProxyShell Exploitation

A comprehensive profile of APT35 (Charming Kitten, Magic Hound, Mint Sandstorm, Phosphorus), the IRGC-linked cyber espionage group conducting long-term, resource-intensive operations against government, military, diplomatic, media, and energy targets worldwide. Covers their evolution from social media manipulation to rapid vulnerability exploitation, their dual espionage-and-ransomware capability, custom malware including BellaCiao and PowerLess, and their relationship to APT42.

apt35 charming-kitten magic-hound
16 min read
Case Study 3 December 2024

Abusing Cloud Permissions to Escalate Privileges

In the twelfth instalment of From the Hacker Desk, Hedgehog Security details how a misconfigured Azure custom role allowed privilege escalation from a low-privileged developer account to Global Administrator — without exploiting a single software vulnerability. The article traces the path through overpermissive role assignments, service principal abuse, and token manipulation, and examines why cloud IAM misconfigurations are the most prevalent and least understood class of risk in modern enterprise environments.

penetration-testing cloud-security azure
16 min read
Threat Intelligence 27 November 2024

APT34: OilRig — Iran's DNS Tunnelling Specialists Targeting Critical Infrastructure Across the Middle East

A comprehensive profile of APT34 (OilRig, Helix Kitten, Earth Simnavaz, Crambus), an Iranian MOIS-linked cyber espionage group conducting sustained campaigns against government, energy, financial, and telecommunications sectors. Covers their signature DNS tunnelling C2 techniques, the catastrophic 2019 tool leak, their evolution from Helminth to cloud-integrated implants, supply chain attacks, the ZeroCleare destructive capability, and their remarkable persistence despite repeated public exposure.

apt34 oilrig helix-kitten
16 min read
Threat Intelligence 20 November 2024

MuddyWater: Iran's MOIS Conglomerate — Turning Legitimate Admin Tools Into Espionage Weapons

A comprehensive profile of MuddyWater (Static Kitten, Mango Sandstorm, Mercury, Seedworm, TA450), the Iranian MOIS-subordinate cyber espionage conglomerate targeting government, telecoms, defence, and energy sectors across the Middle East, Europe, and beyond. Covers their signature abuse of legitimate RMM tools, the conglomerate structure of regionally focused sub-groups, the BugSleep and Phoenix backdoors, their PowerShell-heavy tradecraft, and why this group represents the living-off-the-land threat at scale.

muddywater static-kitten mango-sandstorm
16 min read
Data Breaches 13 November 2024

Capgemini Data Breach: 20 GB of Sensitive Information Stolen — A Deeper Analysis of the Breach and What It Means for the Supply Chain

In September 2024, a threat actor using the alias 'grep' claimed to have compromised Capgemini's systems and exfiltrated 20 GB of sensitive data including source code, credentials, private keys, employee information, and T-Mobile virtual machine logs. We examine what was stolen, what it means for supply chain security, and what organisations should learn from the breach of a €22 billion IT services giant.

data-breach capgemini supply-chain
12 min read
Penetration Testing 6 November 2024

What Is a Threat-Led Penetration Test (TLPT)? — Intelligence-Driven Red Teaming Explained

A comprehensive guide to Threat-Led Penetration Testing (TLPT): what it is, how it differs from conventional penetration testing and red teaming, the frameworks behind it (TIBER-EU, CBEST, DORA), how the testing phases work, what a real TLPT scenario looks like, and why regulatory bodies now require intelligence-driven attack simulation for critical financial infrastructure.

tlpt threat-led-penetration-testing red-teaming
16 min read
Case Study 5 November 2024

Social Engineering the Reception Desk

In the eleventh instalment of From the Hacker Desk, Hedgehog Security recounts a physical social engineering engagement where no technical exploitation was used. Through carefully constructed pretexts, open-source intelligence, and an understanding of human psychology, the team gained controlled access to internal areas including server rooms, executive offices, and restricted floors. The article examines human-layer vulnerabilities, the psychology behind successful social engineering, and why technical controls alone cannot defend against a determined adversary.

penetration-testing social-engineering physical-security
16 min read
Threat Intelligence 30 October 2024

APT1: The Persistent Data Hoarder — How a PLA Unit Stole Hundreds of Terabytes and Changed Cyber Threat Intelligence Forever

A comprehensive profile of APT1 (Comment Crew, Unit 61398), the PLA cyber espionage group exposed by Mandiant's landmark 2013 report. Covers the group's industrial-scale theft of intellectual property from 141 organisations across 20 industries, the WEBC2 'Comment Crew' backdoor technique, the DOJ indictment of five PLA officers, and why the APT1 report remains the single most consequential publication in the history of cyber threat intelligence.

apt1 comment-crew unit-61398
17 min read
From the Hacker's Desk 16 October 2024

XML External Entity Attack: The Parser Vulnerability That Reads Your Files, Scans Your Network, and Nobody Patched

A deep technical examination of XML External Entity (XXE) injection — the OWASP Top 10 vulnerability that allows attackers to read arbitrary files from the server, perform server-side request forgery, scan internal networks, and in some cases achieve remote code execution, all by exploiting how XML parsers handle entity declarations. Covers the XML specification mechanics that make XXE possible, in-band and out-of-band exploitation techniques, blind XXE via error-based and OOB exfiltration, the Billion Laughs denial-of-service variant, language-specific vulnerabilities across Java, PHP, Python, and .NET, real-world discovery during penetration testing, and comprehensive mitigation guidance.

xxe xml-external-entity owasp-top-10
23 min read
Fundamentals 9 October 2024

What Is Spear Phishing? The Targeted Attack That Bypasses Every Technical Control

A comprehensive examination of spear phishing — the targeted social engineering attack that remains the most common initial access vector for both state-sponsored and financially motivated threat actors. Covers the difference between bulk phishing and spear phishing, the reconnaissance lifecycle attackers use to craft convincing pretexts, the technical delivery mechanisms including adversary-in-the-middle credential harvesting and malicious document payloads, real-world examples from APT groups and criminal operations, why technical controls alone cannot prevent it, and practical defensive strategies that combine technology with human resilience.

spear-phishing social-engineering phishing
24 min read
Compliance 2 October 2024

What Is HIPAA? The US Healthcare Privacy and Security Regulation That Reaches Further Than You Think

A comprehensive guide to the Health Insurance Portability and Accountability Act — the US federal regulation that governs the privacy and security of protected health information. Covers the Privacy Rule, Security Rule, and Breach Notification Rule, explains who HIPAA applies to including Business Associates outside the US, examines the technical security requirements and how they map to penetration testing, reviews enforcement actions and penalties, and provides practical guidance for organisations that handle US healthcare data.

hipaa compliance healthcare
23 min read
Case Study 1 October 2024

The VLAN That Wasn't Really Segmented

In the tenth instalment of From the Hacker Desk, Hedgehog Security dissects an engagement where network segmentation existed in design documentation but was not enforced in practice. Misconfigured firewall rules, accumulated exceptions, and a lack of validation testing allowed unrestricted lateral movement between VLANs that should have been isolated. The article examines how segmentation failures occur, how they persist undetected, and how to validate them effectively.

penetration-testing network-segmentation firewall-rules
16 min read
Penetration Testing 25 September 2024

Airspace Penetration Testing: When the Attack Comes from Above

A comprehensive examination of airspace penetration testing — the discipline of using unmanned aerial vehicles to assess an organisation's physical security, wireless security, and detection capabilities from the air. Covers the evolving drone threat landscape, the types of attacks that can be launched from aerial platforms, how organisations can test their resilience to airborne threats, the regulatory framework governing drone operations in the UK, and practical guidance for commissioning airspace security assessments.

airspace-security drone-security physical-security
22 min read
Fundamentals 18 September 2024

Penetration Test vs Vulnerability Scan: They Are Not the Same Thing

The most common misconception in cyber security procurement — the difference between a penetration test and a vulnerability scan, why confusing them leads to poor security decisions, what each involves technically, when to use which, and how they work together as part of a mature security programme. If you have ever received a vulnerability scanner report and been told it was a penetration test, this article is for you.

penetration-testing vulnerability-scanning security-assessment
21 min read
Penetration Testing 11 September 2024

Wi-Fi Penetration Testing: How We Assess Corporate Wireless Security

A comprehensive guide to wireless penetration testing in corporate environments — covering the attack surface that wireless networks create, the techniques used to assess WPA2 and WPA3 in both Personal and Enterprise configurations, rogue access point and evil twin attacks, 802.1X and RADIUS exploitation, wireless network segmentation testing, the tools and methodology used during engagements, and practical defensive guidance for securing corporate wireless infrastructure.

wifi-security wireless-penetration-testing wpa2
23 min read
Case Study 3 September 2024

The Forgotten Test Server That Held the Crown Jewels

In the ninth instalment of From the Hacker Desk, Hedgehog Security describes how an overlooked development server — absent from the asset register and excluded from patching cycles — contained full production database backups including customer PII, financial records, and authentication credentials. The article explores asset management failures, shadow infrastructure, and the systemic risk of development environments that nobody owns.

penetration-testing asset-management shadow-it
15 min read
Case Study 6 August 2024

How an Intern's Laptop Became Our Beachhead

In the eighth instalment of From the Hacker Desk, Hedgehog Security demonstrates how inconsistent endpoint hardening across a corporate estate left a single under-managed device without modern EDR controls or current patching. The article traces how that device — assigned to a summer intern — became the foothold that undermined an otherwise mature security architecture and ultimately led to domain compromise.

penetration-testing endpoint-security asset-management
15 min read
Case Study 2 July 2024

Exploiting Trust Between Two Offices

In the seventh instalment of From the Hacker Desk, Hedgehog Security details how a site-to-site VPN established years prior created implicit trust between a hardened head office and a lightly secured satellite location. By compromising the weaker environment and pivoting through the tunnel, the team achieved domain-level access to the head office without ever setting foot in the building. The article analyses trust relationships, flat networks, and inherited risk.

penetration-testing vpn-security trust-relationships
16 min read
Case Study 4 June 2024

Breaching the Network Through the Coffee Machine

In the sixth instalment of From the Hacker Desk, Hedgehog Security explains how an internet-enabled coffee machine installed for staff convenience exposed a poorly secured web interface on the corporate network. Through enumeration, firmware analysis, and credential extraction, the team demonstrated how consumer IoT embedded in corporate environments introduces systemic risk that traditional security controls cannot address.

penetration-testing iot-security firmware-analysis
15 min read
Case Study 7 May 2024

Phishing the Finance Director in 11 Minutes

In the fifth instalment of From the Hacker Desk, Hedgehog Security walks through a spear-phishing engagement that compromised a senior executive's Microsoft 365 account in under eleven minutes. The article details modern phishing tradecraft including adversary-in-the-middle token harvesting, session cookie replay, and conditional access bypass — demonstrating why multi-factor authentication must be implemented correctly to provide meaningful protection.

penetration-testing phishing social-engineering
16 min read
Case Study 2 April 2024

When the Printer Became the Domain Administrator

In the fourth instalment of From the Hacker Desk, Hedgehog Security details how a multifunction printer with default credentials and exposed SMB shares yielded service account passwords that escalated into full Active Directory domain compromise. The article walks through credential extraction from embedded web interfaces, LDAP bind harvesting, and the systemic risk posed by devices that every organisation owns but few bother to secure.

penetration-testing active-directory printer-security
15 min read
Case Study 5 March 2024

A Paperclip, a Superyacht, and a Bypassed Keylock

In the third instalment of From the Hacker Desk, Hedgehog Security recounts how a physical keylock protecting a superyacht's satellite internet uplink cabinet was bypassed with a common office supply. The article explores the interplay between physical and cyber controls in maritime environments, and details how access to the connectivity stack exposed the vessel's entire network to compromise.

penetration-testing maritime-security physical-security
15 min read
Case Study 6 February 2024

Turning the Lift into a Mobile Reconnaissance Platform

In the second instalment of From the Hacker Desk, Hedgehog Security examines how lift control software exposed diagnostic interfaces over an internal network during an OT-enabled building assessment. The article details how weak segmentation and insecure service configurations allowed the team to transform a lift car into a moving wireless survey and network discovery platform, exposing the dangerous convergence of Operational Technology and corporate IT.

penetration-testing operational-technology iot-security
15 min read
Case Study 2 January 2024

Creating Our Own Access with the Boardroom TV

In the first instalment of From the Hacker Desk, Hedgehog Security describes how an unmanaged smart television in an executive boardroom became the entry point for complete Active Directory domain compromise during an internal penetration test. The article traces the full kill chain from passive reconnaissance through command injection, lateral movement, and credential harvesting to DCSync.

penetration-testing iot-security lateral-movement
14 min read
Penetration Testing 26 December 2023

What actually happens during a professional penetration test from day one to final report?

A step-by-step walkthrough of the professional penetration testing lifecycle, from initial scoping meetings through reconnaissance, exploitation, and the delivery of the final report. Understand what to expect at every stage of a genuine engagement.

penetration-testing methodology security-assessment
16 min read
Penetration Testing 25 December 2023

How do ethical hackers think differently from traditional IT security teams?

Explore the adversarial mindset that separates ethical hackers from defensive security professionals. Learn why thinking like an attacker is essential for identifying the vulnerabilities that automated tools and compliance frameworks miss.

ethical-hacking adversarial-thinking security-culture
16 min read
Penetration Testing 24 December 2023

What is the difference between a vulnerability scan and a penetration test — and why does it matter?

A clear explanation of the fundamental differences between vulnerability scanning and penetration testing, why both matter, and how confusing the two can leave your organisation exposed to real threats.

vulnerability-scanning penetration-testing security-assessment
16 min read
Penetration Testing 23 December 2023

When should a business choose a red team engagement instead of a standard penetration test?

Understand when a traditional penetration test is sufficient and when your organisation needs the more comprehensive, adversarial simulation that a red team engagement provides. Learn how to choose the right approach based on your maturity and objectives.

red-team penetration-testing security-maturity
16 min read
Penetration Testing 22 December 2023

How do penetration testers prioritise findings based on real-world exploitability rather than theoretical risk?

Learn how experienced penetration testers move beyond CVSS scores to assess real-world exploitability, considering environmental context, attack chain potential, and actual business impact when prioritising vulnerabilities.

risk-prioritisation exploitability cvss
16 min read
Penetration Testing 21 December 2023

Can a penetration test measure business impact, not just technical weakness?

An in-depth exploration of can a penetration test measure business impact, not just technical weakness. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing business-risk security-assessment
16 min read
Penetration Testing 20 December 2023

What evidence makes a penetration test report credible at Board level?

An in-depth exploration of what evidence makes a penetration test report credible at board level. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing reporting board-reporting
16 min read
Penetration Testing 19 December 2023

Why do many penetration test reports fail to drive meaningful remediation?

An in-depth exploration of why do many penetration test reports fail to drive meaningful remediation. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing reporting remediation
16 min read
Penetration Testing 18 December 2023

How often should an organisation conduct external and internal penetration tests?

An in-depth exploration of how often should an organisation conduct external and internal penetration tests. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 17 December 2023

What is the role of threat intelligence in modern penetration testing?

An in-depth exploration of what is the role of threat intelligence in modern penetration testing. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing threat-intelligence security-assessment
16 min read
Penetration Testing 16 December 2023

How do testers validate whether a vulnerability is truly exploitable in your environment?

An in-depth exploration of how do testers validate whether a vulnerability is truly exploitable in your environment. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing vulnerability-management exploitation
16 min read
Penetration Testing 15 December 2023

What are the most common misconfigurations discovered during internal network tests?

An in-depth exploration of what are the most common misconfigurations discovered during internal network tests. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing misconfiguration security-assessment
16 min read
Penetration Testing 14 December 2023

How do phishing simulations differ from real adversary social engineering campaigns?

An in-depth exploration of how do phishing simulations differ from real adversary social engineering campaigns. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing social-engineering phishing
16 min read
Penetration Testing 13 December 2023

What does a CREST-aligned penetration testing methodology actually involve?

An in-depth exploration of what does a crest-aligned penetration testing methodology actually involve. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing crest methodology
16 min read
Penetration Testing 12 December 2023

How can penetration testing support ISO 27001 compliance rather than simply tick a box?

An in-depth exploration of how can penetration testing support iso 27001 compliance rather than simply tick a box. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing compliance iso-27001
16 min read
Penetration Testing 11 December 2023

What makes a web application penetration test genuinely thorough?

An in-depth exploration of what makes a web application penetration test genuinely thorough. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing web-application-security security-assessment
16 min read
Penetration Testing 10 December 2023

How do testers assess authentication and session management weaknesses?

An in-depth exploration of how do testers assess authentication and session management weaknesses. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing authentication session-management
16 min read
Penetration Testing 9 December 2023

Why is lateral movement often the most damaging phase of an attack?

An in-depth exploration of why is lateral movement often the most damaging phase of an attack. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing lateral-movement security-assessment
16 min read
Penetration Testing 8 December 2023

How do testers approach Active Directory security in complex enterprise environments?

An in-depth exploration of how do testers approach active directory security in complex enterprise environments. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing active-directory security-assessment
16 min read
Penetration Testing 7 December 2023

What is privilege escalation, and how easily can it occur in mature organisations?

An in-depth exploration of what is privilege escalation, and how easily can it occur in mature organisations. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing privilege-escalation security-assessment
16 min read
Penetration Testing 6 December 2023

How do testers safely exploit vulnerabilities without disrupting live business systems?

An in-depth exploration of how do testers safely exploit vulnerabilities without disrupting live business systems. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing business-risk exploitation
16 min read
Penetration Testing 5 December 2023

What are the biggest misconceptions Boards have about penetration testing?

An in-depth exploration of what are the biggest misconceptions boards have about penetration testing. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing board-reporting security-assessment
16 min read
Penetration Testing 4 December 2023

How do penetration testers evaluate third-party and supply chain exposure?

An in-depth exploration of how do penetration testers evaluate third-party and supply chain exposure. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing supply-chain third-party-risk
16 min read
Penetration Testing 3 December 2023

What are the risks of relying solely on automated testing tools?

An in-depth exploration of what are the risks of relying solely on automated testing tools. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing automation security-assessment
16 min read
Penetration Testing 2 December 2023

How do testers assess cloud environments differently from on-premise infrastructure?

An in-depth exploration of how do testers assess cloud environments differently from on-premise infrastructure. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing cloud-security security-assessment
16 min read
Penetration Testing 1 December 2023

Can penetration testing uncover weaknesses in remote working and VPN architectures?

An in-depth exploration of can penetration testing uncover weaknesses in remote working and vpn architectures. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing vpn-security remote-working
16 min read
Penetration Testing 30 November 2023

How should findings from a penetration test feed into a vulnerability management programme?

An in-depth exploration of how should findings from a penetration test feed into a vulnerability management programme. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing vulnerability-management security-assessment
16 min read
Penetration Testing 29 November 2023

What does a high-quality executive summary in a penetration test report look like?

An in-depth exploration of what does a high-quality executive summary in a penetration test report look like. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing reporting executive-summary
16 min read
Penetration Testing 28 November 2023

How do testers quantify the likelihood of exploitation in the wild?

An in-depth exploration of how do testers quantify the likelihood of exploitation in the wild. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing exploitation security-assessment
16 min read
Penetration Testing 27 November 2023

What are the typical root causes behind recurring critical vulnerabilities?

An in-depth exploration of what are the typical root causes behind recurring critical vulnerabilities. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 26 November 2023

How does physical penetration testing differ from digital testing?

An in-depth exploration of how does physical penetration testing differ from digital testing. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing physical-security security-assessment
16 min read
Penetration Testing 25 November 2023

Can a penetration test demonstrate resilience against ransomware?

An in-depth exploration of can a penetration test demonstrate resilience against ransomware. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing ransomware security-assessment
16 min read
Penetration Testing 24 November 2023

How do testers approach API security assessments?

An in-depth exploration of how do testers approach api security assessments. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing api-security security-assessment
16 min read
Penetration Testing 23 November 2023

What are the early warning signs that your organisation is ready for a red team simulation?

An in-depth exploration of what are the early warning signs that your organisation is ready for a red team simulation. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing red-team security-assessment
16 min read
Penetration Testing 22 November 2023

How can businesses ensure their remediation actions are effective after a test?

An in-depth exploration of how can businesses ensure their remediation actions are effective after a test. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing remediation business-risk
16 min read
Penetration Testing 21 November 2023

What is the value of retesting, and when should it be conducted?

An in-depth exploration of what is the value of retesting, and when should it be conducted. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing retesting security-assessment
16 min read
Penetration Testing 20 November 2023

How do testers simulate insider threat scenarios?

An in-depth exploration of how do testers simulate insider threat scenarios. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing insider-threat security-assessment
16 min read
Penetration Testing 19 November 2023

What role does password hygiene still play in modern breach scenarios?

An in-depth exploration of what role does password hygiene still play in modern breach scenarios. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing password-security security-assessment
16 min read
Penetration Testing 18 November 2023

How are wireless networks typically compromised during an engagement?

An in-depth exploration of how are wireless networks typically compromised during an engagement. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing wireless-security security-assessment
16 min read
Penetration Testing 17 November 2023

What is the real impact of outdated SSL/TLS configurations?

An in-depth exploration of what is the real impact of outdated ssl/tls configurations. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing ssl-tls security-assessment
16 min read
Penetration Testing 16 November 2023

How do testers measure attack surface exposure from publicly available information?

An in-depth exploration of how do testers measure attack surface exposure from publicly available information. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing attack-surface security-assessment
16 min read
Penetration Testing 15 November 2023

What does “exploitation proof of concept” actually mean in a report?

An in-depth exploration of what does “exploitation proof of concept” actually mean in a report. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing reporting exploitation
16 min read
Penetration Testing 14 November 2023

How can penetration testing reduce cyber insurance premiums?

An in-depth exploration of how can penetration testing reduce cyber insurance premiums. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing cyber-insurance security-assessment
16 min read
Penetration Testing 13 November 2023

What are the ethical boundaries of professional hacking?

An in-depth exploration of what are the ethical boundaries of professional hacking. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing ethics security-assessment
16 min read
Penetration Testing 12 November 2023

How do penetration testers balance stealth with evidence gathering?

An in-depth exploration of how do penetration testers balance stealth with evidence gathering. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing stealth-testing security-assessment
16 min read
Penetration Testing 11 November 2023

What makes a penetration test valuable to security operations teams?

An in-depth exploration of what makes a penetration test valuable to security operations teams. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 10 November 2023

How should organisations prepare internally before commissioning a penetration test?

An in-depth exploration of how should organisations prepare internally before commissioning a penetration test. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 9 November 2023

What differentiates a high-assurance testing firm from a commodity provider?

An in-depth exploration of what differentiates a high-assurance testing firm from a commodity provider. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 8 November 2023

How do testers adapt methodology when targeting operational technology or IoT environments?

An in-depth exploration of how do testers adapt methodology when targeting operational technology or iot environments. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing methodology iot-security
16 min read
Penetration Testing 7 November 2023

How does penetration testing fit into a broader Detect, Defend and Disrupt cyber strategy?

An in-depth exploration of how does penetration testing fit into a broader detect, defend and disrupt cyber strategy. This article provides practical insights drawn from real-world penetration testing engagements, helping security professionals and decision-makers understand the implications and take informed action.

penetration-testing security-assessment risk-management
16 min read
Penetration Testing 31 October 2023

How much does a penetration test cost for a medium-sized UK business?

A transparent breakdown of penetration testing costs for medium-sized UK businesses, covering the factors that drive pricing, what to expect from budget to premium engagements, and how to evaluate whether a quote represents genuine value or an expensive vulnerability scan dressed up as a pen test.

penetration testing cost pricing
8 min read
Penetration Testing 24 October 2023

What factors influence the price of a penetration test?

An honest examination of the variables that shape penetration testing pricing — scope complexity, environment size, testing methodology, tester seniority, reporting requirements, and certification standards — helping procurement and security teams understand what drives cost and where to allocate budget effectively.

penetration testing cost pricing
8 min read
Penetration Testing 17 October 2023

How long does a typical penetration test take to complete?

A practical guide to penetration testing timelines, covering the typical duration for different engagement types, what affects the testing window, and why the right answer to 'how long will it take' depends entirely on what you need to learn about your security posture.

penetration testing security-assessment risk-management
8 min read
Penetration Testing 10 October 2023

How do I compare penetration testing quotes from different providers?

Guidance on evaluating and comparing penetration testing proposals, identifying the key differentiators between commodity scanning and genuine manual testing, and understanding what to look for in scope definitions, methodology descriptions, and deliverable commitments.

penetration testing pricing procurement
8 min read
Penetration Testing 3 October 2023

What credentials should a penetration testing company hold?

An overview of the professional credentials, certifications, and accreditations that distinguish qualified penetration testing providers from those offering automated scanning as manual testing, including CREST, CHECK, Cyber Scheme, and individual tester qualifications.

penetration testing credentials authentication
8 min read
Penetration Testing 26 September 2023

What is the difference between CREST, CHECK and Cyber Scheme certifications?

A clear comparison of the three primary UK penetration testing certification bodies — CREST, CHECK, and Cyber Scheme — explaining what each certifies, the assessment standards involved, and which certification matters most depending on your sector and regulatory obligations.

penetration testing CREST certification
8 min read
Penetration Testing 19 September 2023

Can penetration testing disrupt our live production systems?

An honest assessment of the risks penetration testing poses to live production environments, the safeguards professional testers employ, how rules of engagement protect critical systems, and what to discuss with your provider before testing begins to minimise operational disruption.

penetration testing business-continuity risk-management
8 min read
Penetration Testing 12 September 2023

Do I need Board approval before commissioning a penetration test?

Guidance on the governance requirements around commissioning penetration testing, including when Board or senior leadership approval is necessary, what authorisation documentation should be in place, and how to frame the conversation for non-technical stakeholders.

penetration testing governance executive-reporting
8 min read
Penetration Testing 5 September 2023

What information does a penetration testing provider need before starting?

A practical checklist of the information and access requirements a penetration testing provider needs before an engagement can begin, covering scoping data, network documentation, credentials, points of contact, and rules of engagement.

penetration testing provider-selection procurement
8 min read
Penetration Testing 29 August 2023

How do we define the scope of a penetration test properly?

A detailed guide to defining penetration testing scope effectively, avoiding the common pitfalls that lead to wasted effort and missed risk, and ensuring the engagement is designed to answer the questions that matter most to the organisation.

penetration testing scoping pre-engagement
8 min read
Penetration Testing 22 August 2023

What happens if critical vulnerabilities are found during testing?

An explanation of the immediate notification process when critical or high-severity vulnerabilities are discovered during a penetration test, including how testers communicate urgent findings, what actions the organisation should take, and how these findings are handled in the final report.

penetration testing security-assessment risk-management
8 min read
Penetration Testing 15 August 2023

Will the testers require administrative credentials?

Clarification on when and why penetration testers request administrative or privileged credentials, the difference between black box and authenticated testing approaches, and how credential provision affects the depth and value of the engagement.

penetration testing credentials authentication
8 min read
Penetration Testing 8 August 2023

Should we inform staff before conducting an internal penetration test?

Practical guidance on whether and how to communicate internally before a penetration test, balancing the benefits of realistic testing conditions against the risks of alarming staff, disrupting operations, or triggering unnecessary incident response procedures.

penetration testing awareness internal-communication
8 min read
Penetration Testing 1 August 2023

How confidential is the penetration testing report?

An examination of the confidentiality protections applied to penetration testing reports, including data handling procedures, secure delivery mechanisms, retention policies, and the contractual obligations that protect sensitive findings from unauthorised disclosure.

penetration testing reporting deliverables
8 min read
Penetration Testing 25 July 2023

Who owns the data generated during a penetration test?

Clarification on data ownership, intellectual property rights, and handling obligations for the information generated during a penetration testing engagement, including report ownership, raw data, proof-of-concept code, and any sensitive data discovered during testing.

penetration testing data-handling confidentiality
8 min read
Penetration Testing 18 July 2023

How do penetration testers protect sensitive information discovered during testing?

A detailed look at the data protection measures professional penetration testers employ when they encounter sensitive information during an engagement, covering encryption, secure storage, data minimisation, and the contractual frameworks that govern handling of discovered data.

penetration testing pre-engagement planning
8 min read
Penetration Testing 11 July 2023

Can penetration testing be done remotely?

An assessment of remote penetration testing capabilities and limitations, covering which testing types work effectively over VPN or cloud connectivity, which require on-site presence, and how to ensure remote engagements deliver the same quality and depth as on-premises testing.

penetration testing remote-testing methodology
8 min read
Penetration Testing 4 July 2023

Do we need cyber insurance before commissioning a penetration test?

Guidance on the relationship between cyber insurance and penetration testing, including whether insurance is a prerequisite, how testing results affect premiums and coverage, and why some insurers now require evidence of regular testing as a condition of policy renewal.

penetration testing cyber insurance risk-management
8 min read
Penetration Testing 27 June 2023

How often do regulators expect penetration testing to be performed?

A summary of regulatory expectations for penetration testing frequency across key UK and international frameworks, including PCI DSS, ISO 27001, GDPR, NIS Regulations, and sector-specific requirements from the FCA, ICO, and other regulatory bodies.

penetration testing regulation compliance
8 min read
Penetration Testing 20 June 2023

What evidence will I receive for audit or compliance purposes?

A description of the deliverables and evidence a professional penetration testing engagement produces for audit and compliance purposes, including report formats, executive summaries, technical findings, remediation tracking, and retest confirmation suitable for regulators and auditors.

penetration testing compliance regulation
8 min read
Penetration Testing 13 June 2023

Can penetration testing help with Cyber Essentials Plus certification?

An explanation of how penetration testing supports and complements Cyber Essentials Plus certification, the differences between a CE+ assessment and a full penetration test, and why organisations pursuing CE+ should consider additional testing to address risks the scheme does not cover.

penetration testing Cyber Essentials certification
8 min read
Penetration Testing 6 June 2023

What is the difference between black box, grey box and white box testing — and which should I choose?

A comprehensive comparison of black box, grey box, and white box penetration testing approaches, explaining the trade-offs between realism and coverage, the scenarios where each approach delivers the most value, and how to choose the right methodology for your objectives and budget.

penetration testing testing-methodology black-box
8 min read
Penetration Testing 30 May 2023

How do I ensure the penetration test aligns with our specific industry risks?

Guidance on tailoring penetration testing to address sector-specific threats and regulatory requirements, ensuring the engagement focuses on the attack vectors, compliance obligations, and business risks that are most relevant to your industry rather than delivering a generic assessment.

penetration testing industry-specific risk-alignment
8 min read
Penetration Testing 23 May 2023

Can we limit testing to out-of-hours activity?

A practical discussion of scheduling penetration testing outside business hours, covering which testing types can be safely deferred, the operational implications of out-of-hours work, cost considerations, and how to balance minimal disruption with maximum testing effectiveness.

penetration testing scheduling planning
8 min read
Penetration Testing 16 May 2023

What level of reporting detail should I expect for technical teams versus executives?

An examination of the dual-audience reporting challenge in penetration testing, explaining what technical teams need for remediation, what executives need for decision-making, and what a well-structured report looks like when it serves both audiences without compromising either.

penetration testing reporting deliverables
8 min read
Penetration Testing 9 May 2023

Will testers attempt password spraying or brute force attacks?

Clarification on whether and how penetration testers use password spraying, brute force, and credential-stuffing techniques during engagements, the risks these techniques pose to production systems, and how rules of engagement govern aggressive authentication testing.

penetration testing password-security brute-force
8 min read
Penetration Testing 2 May 2023

How do providers ensure testing is legal and authorised?

An overview of the legal and authorisation framework that governs penetration testing in the UK, including the Computer Misuse Act considerations, authorisation documentation, scope boundaries, and the professional standards that ensure testing remains lawful and properly sanctioned.

penetration testing legal authorisation
8 min read
Penetration Testing 25 April 2023

What contractual protections should be in place before testing begins?

A guide to the essential contractual elements that should be agreed before a penetration testing engagement begins, covering liability, indemnification, data protection, scope boundaries, non-disclosure obligations, and the rules of engagement that protect both parties.

penetration testing contract procurement
8 min read
Penetration Testing 18 April 2023

Can penetration testing identify insider threats?

An assessment of how penetration testing can simulate and identify insider threat scenarios, the difference between insider simulation and standard internal testing, and the additional value organisations gain from testing their defences against trusted users with legitimate access.

penetration testing insider-threat internal-testing
8 min read
Penetration Testing 11 April 2023

How do we validate that remediation actions have fully resolved issues?

A practical guide to remediation validation and retesting, explaining how to confirm that fixes genuinely resolve the identified vulnerabilities rather than simply masking symptoms, the role of retesting in closing the remediation loop, and common validation pitfalls.

penetration testing remediation vulnerability-management
8 min read
Penetration Testing 4 April 2023

What is the difference between annual testing and continuous testing?

A comparison of periodic annual penetration testing versus continuous or programme-based testing approaches, explaining the strengths and limitations of each model, the scenarios where continuous testing delivers superior value, and how to transition from annual assessments to an ongoing testing programme.

penetration testing continuous-testing testing-frequency
8 min read
Penetration Testing 28 March 2023

Is it better to use the same provider each year or rotate suppliers?

An honest analysis of the advantages and disadvantages of retaining a penetration testing provider versus rotating suppliers, covering the trade-offs between institutional knowledge and fresh perspectives, and how to structure a testing programme that captures the benefits of both approaches.

penetration testing provider-selection procurement
8 min read
Penetration Testing 21 March 2023

How do I evaluate the real-world experience of a penetration testing team?

Guidance on assessing the practical experience and capability of a penetration testing team beyond certifications and sales presentations, including the questions to ask, the indicators of genuine expertise, and the red flags that suggest a provider lacks the depth to deliver meaningful results.

penetration testing provider-selection expertise
8 min read
Penetration Testing 14 March 2023

What tools do professional penetration testers typically use?

An overview of the tools and technologies professional penetration testers use during engagements, explaining why tools alone don't constitute a penetration test, how manual testing and tool-based scanning complement each other, and what the tool selection tells you about a provider's methodology.

penetration testing tools methodology
8 min read
Penetration Testing 7 March 2023

Can penetration testing simulate ransomware deployment safely?

An examination of how penetration testers safely simulate ransomware attack chains without deploying actual malware, the techniques used to demonstrate encryption, exfiltration, and lateral movement risk, and why ransomware simulation provides valuable preparedness insight.

penetration testing ransomware malware
8 min read
Penetration Testing 28 February 2023

What KPIs should I measure to assess penetration testing effectiveness?

A framework for measuring the effectiveness of a penetration testing programme using meaningful key performance indicators, moving beyond simple finding counts to metrics that demonstrate genuine security improvement, risk reduction, and programme maturity over time.

penetration testing KPIs metrics
8 min read
Penetration Testing 21 February 2023

How do penetration testing results integrate with a SIEM or SOC?

An exploration of how penetration testing results should feed into Security Operations Centre workflows and SIEM platforms, including detection gap analysis, alert tuning, threat hunting improvements, and the value of purple team exercises that bridge offensive and defensive capabilities.

penetration testing SIEM SOC
8 min read
Penetration Testing 14 February 2023

What is the typical turnaround time for a final report?

Guidance on realistic report delivery timelines for penetration testing engagements, covering what affects turnaround time, what to expect in draft and final report stages, and why a provider who delivers a report within 24 hours of testing may not be delivering a report worth reading.

penetration testing reporting deliverables
8 min read
Penetration Testing 7 February 2023

Are penetration tests covered under GDPR processing agreements?

An examination of the GDPR implications of penetration testing, including whether testers are data processors, when a Data Processing Agreement is required, how to handle personal data discovered during testing, and the Article 28 obligations that apply to the testing provider.

penetration testing GDPR data-protection
8 min read
Penetration Testing 31 January 2023

Can testing be tailored to mergers and acquisitions due diligence?

A guide to using penetration testing as part of mergers and acquisitions due diligence, explaining how targeted assessments can identify inherited cyber risk, validate security claims made during the acquisition process, and inform post-merger integration planning.

penetration testing M&A due-diligence
8 min read
Penetration Testing 24 January 2023

What is included in a retest, and is it charged separately?

Clarification on what a penetration testing retest involves, what should be included in the original engagement price versus charged separately, how retesting validates remediation effectiveness, and what to look for in a provider's retest policy before signing the contract.

penetration testing retesting remediation
8 min read
Penetration Testing 17 January 2023

How do penetration testers assess third-party SaaS platforms?

An exploration of the methodologies and constraints involved in testing third-party SaaS platforms, including shared responsibility boundaries, vendor authorisation requirements, API security assessment, and the practical approaches testers use when direct infrastructure access is unavailable.

penetration testing SaaS cloud-security
8 min read
Penetration Testing 10 January 2023

Can testing cover mobile applications and APIs together?

A guide to combined mobile application and API penetration testing, explaining why testing these components together provides superior coverage compared to isolated assessments, the methodology differences, and how to scope an engagement that addresses both attack surfaces effectively.

penetration testing mobile-testing application-security
8 min read
Penetration Testing 3 January 2023

How do we ensure minimal reputational risk during testing?

Practical guidance on managing reputational risk during penetration testing engagements, covering communication protocols, scope restrictions for customer-facing systems, social engineering boundaries, and the contractual and operational safeguards that prevent testing from causing brand damage.

penetration testing reputational-risk risk-management
8 min read
Penetration Testing 27 December 2022

What cyber maturity level should we reach before commissioning a red team?

Guidance on assessing organisational readiness for red team engagements, explaining the prerequisites in terms of security controls, detection capabilities, incident response maturity, and penetration testing history that should be in place before a red team exercise delivers meaningful value.

penetration testing red-team adversary-simulation
8 min read
Penetration Testing 20 December 2022

How do we prepare our incident response team for a live test?

A practical guide to preparing incident response teams for live penetration testing or red team exercises, covering pre-engagement briefings, detection expectations, escalation protocols, and how to structure the exercise so the IR team gains maximum learning value from the experience.

penetration testing incident-response preparedness
8 min read
Penetration Testing 13 December 2022

What are the warning signs of a low-quality penetration testing provider?

A guide to identifying low-quality penetration testing providers before signing a contract, covering the red flags in proposals, pricing, methodology descriptions, and sample reports that indicate an engagement will deliver automated scanning rather than genuine manual testing.

penetration testing provider-selection procurement
8 min read
Penetration Testing 6 December 2022

Should penetration testing be combined with a vulnerability management programme?

An analysis of how penetration testing and vulnerability management programmes complement each other, the risks of relying on either in isolation, and how to integrate both into a cohesive security assurance framework that provides continuous monitoring and periodic deep-dive assessment.

penetration testing vulnerability-management scanning
8 min read
Penetration Testing 29 November 2022

How do I justify penetration testing expenditure to the Board?

A practical framework for building a compelling business case for penetration testing investment, translating technical security concerns into business risk language that resonates with board-level decision-makers, and demonstrating measurable return on security investment.

penetration testing cost budget
8 min read
Penetration Testing 22 November 2022

What questions should I ask before signing a penetration testing contract?

A comprehensive checklist of questions to ask before committing to a penetration testing engagement, covering scope, methodology, tester qualifications, reporting standards, data handling, retesting, and the contractual protections that ensure the engagement delivers genuine security value.

penetration testing contract procurement
8 min read
Topics

What we write about.

Pen Test Insights
Common vulnerabilities we find, what they mean for your business, and how to fix them — drawn from real (anonymised) engagements.
CE & Compliance
Practical guidance on Cyber Essentials, GDPR, PCI DSS, and other compliance frameworks. What's changed, what's coming, and how to prepare.
Threat Landscape
Emerging threats, notable CVEs, and what the latest attack trends mean for UK organisations. Intelligence you can act on.
Stay Informed

Want to be notified?

Drop us a message to be added to our mailing list. Low volume, high signal — we'll only email when we've got something worth reading.

Notify Me Back to Home