Insights &amp; Blog

Penetration Testing 3 February 2026

How to Choose a Penetration Testing Provider

Three quotes arrive for the annual pen test. The prices range from £4,000 to £18,000. The scope descriptions look similar. The proposal documents use the same terminology. The procurement team recommends the cheapest option — all three are 'pen tests,' so why pay more? This article explains why that logic is wrong, what separates a high-quality provider from a low-quality one, and how to evaluate methodology, reporting quality, and expertise so the organisation gets a pen test that actually improves security — rather than a compliance artefact that provides false assurance.

provider selection methodology reporting quality

Case Study 3 February 2026

Breaking Into the Smart Building Management System

In the twenty-sixth instalment of From the Hacker Desk, Hedgehog Security demonstrates how exposed BACnet services, default credentials on building controllers, and the convergence of IT and operational technology within a modern office tower allowed deep access to the building management system controlling HVAC, lighting, metering, and physical access. The article explores smart building security as an emerging discipline, the risks of environmental manipulation, and why the operational technology that keeps a building habitable deserves the same security scrutiny as the IT network it increasingly shares.

penetration-testing building-management bms-security

Penetration Testing 27 January 2026

Why Penetration Testing Should Challenge Assumptions Rather Than Confirm Comfort

An organisation commissions a pen test and receives a report with four low findings and no critical or high issues. The CISO presents the results to the board: 'We passed.' Everyone is relieved. But the test was scoped to exclude the cloud environment, the rules of engagement prohibited social engineering, the testing window was three days for a 1,200-host network, and the provider was selected because they were the cheapest quote. The results are accurate — within the constraints. The comfort they provide is false — because the constraints were designed, consciously or not, to produce a comfortable result. This article argues that the purpose of a pen test is to challenge assumptions, not confirm them.

assumptions challenge comfort

Incident Response 20 January 2026

The Role of Penetration Testing in Incident Preparedness

The pen test report describes a chain: phishing email delivers a payload, initial access on a workstation, LLMNR poisoning captures credentials, lateral movement to the file server, privilege escalation via a Kerberoastable service account, and Domain Admin in under three hours. Six months later, the real incident follows the same chain — almost step for step. This isn't coincidence. Pen testers and real attackers use the same techniques because they exploit the same weaknesses. The pen test report is the closest thing an organisation has to a preview of its next breach. This article explores how pen test findings mirror real breach pathways, how to use them to prepare for incidents, and why organisations that test regularly respond better when real attacks arrive.

incident response breach pathways incident preparedness

Security Strategy 13 January 2026

How to Measure the Real Value of Penetration Testing Beyond Pass or Fail

Did we pass the pen test? It's the most common question leadership asks — and it's the wrong one. A penetration test isn't an exam. There's no pass mark, no certificate of invulnerability, no binary outcome that means the organisation is 'secure.' The real value of a pen test is measured in what changes afterwards: the vulnerabilities remediated, the detection gaps closed, the architectural improvements implemented, and the compounding risk reduction across successive engagements. This article explains how to measure that value — with metrics that demonstrate genuine security improvement rather than a reassuring binary.

metrics measurement value

Case Study 6 January 2026

Drone-to-Network Pivot — Landing Inside the Firewall

In the twenty-fifth instalment of From the Hacker Desk — and the fifth in our drone security series — Hedgehog Security demonstrates how a drone configured to automatically sync captured imagery to a corporate server became a network bridgehead. Once connected to the corporate Wi-Fi for file upload, the compromised drone inherited internal trust, bypassed perimeter controls, and provided a pivot point into internal systems. The article examines insecure device onboarding, poor NAC enforcement, and the segmentation failures that allowed an airborne device to become an inside threat.

penetration-testing uav-security network-pivot

Penetration Testing 6 January 2026

Why Transparency in Penetration Testing Builds Trust Between Testers, Defenders, and Leadership

A penetration test involves a third party attempting to compromise your organisation's systems. That dynamic — outsiders probing your defences, finding your weaknesses, documenting your failures — can either build trust or destroy it. The difference is transparency: in scoping, in communication during testing, in honest reporting, and in the debrief. This article explores how transparency at every stage transforms a pen test from an adversarial exercise into a partnership that makes the organisation genuinely safer.

transparency trust communication

Security Strategy 30 December 2025

How Pen Test Reports Can Prioritise Security Investment Intelligently

Most security budgets are built reactively — a breach at a competitor triggers MFA investment, a ransomware headline accelerates endpoint detection procurement, an auditor's finding forces a logging upgrade. The pen test report sits in a shared drive, referenced occasionally but rarely used as the investment prioritisation tool it should be. This article explains how to use pen test findings — particularly attack chains, effort-to-impact ratios, and longitudinal data — to make evidence-based security investment decisions that address demonstrated risk rather than perceived threat.

security investment budgeting ROI

Security Architecture 23 December 2025

The Relationship Between Penetration Testing and Secure Architecture Design

Most pen test findings are treated as configuration issues — fix the setting, close the finding. But the most valuable findings are the ones that reveal architectural weaknesses: the flat network that enables lateral movement, the trust model that grants excessive access, the authentication architecture that can't enforce MFA where it matters. These findings don't get fixed by changing a GPO. They get fixed by changing the architecture. This article explores the feedback loop between penetration testing and secure design — and why organisations that feed test results back into their architecture produce systems that are fundamentally harder to compromise.

security architecture secure design feedback loop

Penetration Testing 16 December 2025

Why Penetration Testing Should Evolve as the Business Evolves

The business migrated to AWS. The company acquired a competitor. A new customer portal launched. The workforce shifted to hybrid. The supply chain added three new SaaS providers. And the penetration test? Same scope as last year. Same internal infrastructure test. Same methodology. Same five-day window. The business evolved. The testing didn't. This article explains why static pen testing produces diminishing returns — and how to build a programme that adapts to the business, testing what matters now rather than what mattered two years ago.

evolving scope business change attack surface

Compliance & Regulation 9 December 2025

DORA Requirements for Penetration Testing: An In-Depth Guide

The Digital Operational Resilience Act (DORA) has made penetration testing a legal obligation for financial entities operating in the EU. Not a recommendation. Not a best practice. A regulation — with two distinct tiers of testing requirements, specific tester qualifications, mandatory purple teaming, and supervisory oversight. This in-depth guide covers every aspect of DORA's penetration testing requirements: the general resilience testing programme under Articles 24–25, the advanced Threat-Led Penetration Testing (TLPT) framework under Articles 26–27, and what financial entities need to do to comply.

DORA TLPT TIBER-EU

Case Study 2 December 2025

Cracking the Drone Controller — When Firmware Becomes the Weak Link

In the twenty-fourth and final instalment of the drone series within From the Hacker Desk, Hedgehog Security shifts focus from the aircraft to the handheld controller. Through firmware extraction and reverse engineering, we identified hard-coded credentials, an unencrypted firmware update channel, and authentication tokens that could be used to impersonate the controller to the manufacturer's cloud infrastructure. The article details firmware extraction methodology, update integrity validation failures, and the supply chain risks inherent in consumer and commercial UAV ecosystems.

penetration-testing firmware-analysis reverse-engineering

Risk & Governance 2 December 2025

How Penetration Testing Fits into a Broader Risk Management and Governance Framework

A penetration test produces findings. Risk management determines what to do about them. Governance ensures the decisions are made, tracked, and reported. Without this framework, pen test findings sit in a report. Within it, they become entries in the risk register, inputs to the risk treatment plan, evidence for the audit committee, and data points in the board's risk reporting. Here's how penetration testing connects to — and strengthens — the governance structure that turns identified risk into managed risk.

risk management governance risk register

Compliance & Certification 25 November 2025

How Penetration Testing Supports and Elevates Cyber Essentials Plus Certification

Cyber Essentials Plus certifies that an organisation meets a baseline of technical controls. A penetration test demonstrates what happens when a motivated attacker encounters those controls in practice. Together, they provide something neither achieves alone: verified baseline security with evidence of real-world resilience. Here's how pen testing supports CE+ certification, reveals the gaps it doesn't cover, and elevates the organisation's security posture beyond the certification baseline.

Cyber Essentials Cyber Essentials Plus compliance

Penetration Testing 18 November 2025

What a Mature Penetration Testing Programme Looks Like Over Multiple Years

A penetration test is an event. A penetration testing programme is a strategy. The difference determines whether the organisation gets a snapshot once a year or a compounding improvement trajectory that measurably reduces risk over time. This article maps the journey from first engagement through multi-year maturity — showing how scope evolves, what metrics matter, how testing integrates with red and purple teaming, and what the board should see at each stage.

programme maturity multi-year testing security strategy

Penetration Testing 11 November 2025

Remediation Validation and Retesting: Closing the Loop on Penetration Testing

A finding marked 'remediated' in a tracker is not the same as a finding that's been verified as fixed. Without validation, the remediation programme is an act of faith — the GPO might be on the wrong OU, the firewall rule might have an exception, the detection rule might miss the variant. Retesting closes the loop: it confirms that fixes work, demonstrates measurable improvement, and transforms the pen test from a one-time event into a continuous improvement cycle.

remediation retesting validation

Technical Deep Dive 4 November 2025

Custom Payloads and Evasion: A Deep Dive into Metasploit Payload Crafting

The exploit lands. The payload deploys. Windows Defender quarantines it in 200 milliseconds. The shell never opens. Modern endpoint security has made default Metasploit payloads largely ineffective against up-to-date systems — and that's precisely why understanding custom payload creation, encoding, encryption, and evasion is essential for any penetration tester working against real-world environments. This deep dive covers the full payload crafting pipeline: from msfvenom basics through multi-layer encoding, custom templates, and the techniques that actually work against modern EDR.

metasploit msfvenom payloads

Case Study 4 November 2025

Exploiting GPS Spoofing Against a Security Patrol Drone

In the twenty-third instalment of From the Hacker Desk, Hedgehog Security demonstrates how GPS spoofing techniques could alter the flight path of an autonomous security patrol drone without physical or network access to the aircraft. The article explains the mechanics of civilian GNSS signal manipulation, the limitations of satellite navigation without integrity checking, and why organisations that rely on autonomous UAV patrols for perimeter security must understand the exploitable assumptions built into civilian GPS.

penetration-testing gps-spoofing drone-security

Technical Deep Dive 28 October 2025

Metasploit: A Deep Dive into the Exploitation Framework

Metasploit is the framework that turns a vulnerability into a compromise — bridging the gap between 'this system is vulnerable' and 'here's proof of what an attacker can do with it.' This deep dive covers the architecture, the module system, Meterpreter, payload selection, database integration, post-exploitation, and how professional penetration testers use Metasploit as part of a disciplined engagement — not a point-and-click hacking tool.

metasploit exploitation meterpreter

Insights & Strategy 21 October 2025

"No Critical Findings" Does Not Mean Secure

A comprehensive examination of why a clean penetration test report can be the most dangerous document an organisation receives. Covering the gap between what 'no critical findings' actually means and how boards interpret it, the hidden risk in finding chains and attack paths, the structural limits of point-in-time testing, real-world examples where clean reports preceded catastrophic breaches, and practical guidance for organisations, CISOs, and boards on interpreting pen test results without creating false confidence.

penetration-testing risk-management false-confidence

22 min read

Penetration Testing 21 October 2025

"No Critical Findings" Does Not Mean Secure

The pen test report comes back with zero critical findings. The board is reassured. The CISO defers the MFA project. The organisation moves on — secure in the knowledge that a professional tester couldn't find anything critical. Except 'no critical findings' doesn't mean the organisation is secure. It means the tester didn't find critical-severity vulnerabilities within this scope, timeframe, and methodology. The difference between those two statements is where residual risk lives.

residual risk risk communication false confidence

Penetration Testing 14 October 2025

Common Mistakes Organisations Make When Interpreting Pen Test Reports

The pen test report is excellent. The testing was thorough. The findings are well-evidenced and the remediation is specific. And then the organisation misinterprets it — fixating on the wrong findings, drawing false conclusions from the severity scores, treating the report as a verdict rather than a snapshot, and directing remediation effort at the loudest numbers instead of the greatest risk. Here are the mistakes we see most often, and how to avoid them.

reporting interpretation remediation

Case Study 7 October 2025

Turning a Corporate Drone into an Airborne Reconnaissance Platform

In the twenty-second instalment of From the Hacker Desk, Hedgehog Security examines how a corporate drone deployed for marketing footage had inadvertently become a repository of sensitive intelligence — stored video revealing site layouts and security configurations, GPS logs mapping months of corporate activity, cached Wi-Fi credentials for every network the device had connected to, and metadata exposing client sites and personnel. The article discusses how UAVs passively collect and retain data far beyond their intended purpose, and how that accumulated intelligence can be weaponised by an attacker who gains access to the device.

penetration-testing uav-security data-exposure

Penetration Testing 7 October 2025

How Pen Test Reports Support Regulatory, Legal, and Insurance Discussions

The penetration test finishes in two weeks. The report serves the organisation for years — reviewed by auditors during certification, submitted to insurers during renewal, disclosed to regulators during inquiries, and produced as evidence if a breach occurs. A report written only for the IT team misses the majority of its audience. Here's how pen test reports function as regulatory, legal, and insurance artefacts — and how to ensure yours is an asset rather than a liability.

compliance regulation cyber insurance

Penetration Testing 30 September 2025

Executive Summaries: The Two Pages That Fund or Fail Remediation

The executive summary is the only section of a penetration test report that the people who control the budget will read. If it communicates business risk in language they understand, remediation gets funded. If it communicates technical findings in language they don't, the report gets filed. Here's how to write the two pages that determine whether anything changes.

executive summary reporting board communication

Technical Deep Dive 23 September 2025

Netcat: A Deep Dive into the Swiss Army Knife of Networking

Netcat has been called the Swiss Army knife of networking since 1995 — and for good reason. It reads and writes data across network connections using TCP or UDP, and that deceptively simple capability underpins port scanning, banner grabbing, file transfer, bind and reverse shells, pivoting, and ad-hoc network debugging. This deep dive covers every mode, every variant, and how penetration testers use Netcat as a building block for techniques that more sophisticated tools are built upon.

netcat ncat networking

Penetration Testing 16 September 2025

Evidence, Screenshots, and Reproduction Steps: Building Trust in Pen Test Findings

A finding without evidence is an opinion. A finding with a screenshot is a claim. A finding with reproduction steps, timestamped evidence, and a verification method is a fact that drives action. Here's why evidence quality determines whether findings get fixed, get disputed, or get ignored — and what good evidence actually looks like.

reporting evidence screenshots

Penetration Testing 9 September 2025

Writing Findings That Teams Can Actually Remediate

The most common reason penetration test findings don't get fixed isn't disagreement with the severity, lack of budget, or technical impossibility. It's that the remediation guidance is too vague for the team receiving it to implement without further research. Here's how to write findings that development, infrastructure, and security teams can realistically act on — and why specificity is the difference between a finding that gets fixed and one that gets backlogged.

reporting remediation actionable findings

Case Study 2 September 2025

Hijacking the Drone Above the Construction Site

In the twenty-first instalment of From the Hacker Desk, Hedgehog Security examines a security assessment of commercial UAVs used for aerial surveying at a construction firm. Testing revealed unsecured telemetry channels, weak controller-aircraft pairing mechanisms, exposed ground station software, and the potential for command injection, surveying data manipulation, and controlled denial of service. The article explores the emerging attack surface of commercial drone operations and why organisations deploying UAVs must treat them as networked computing platforms, not flying cameras.

penetration-testing uav-security drone-hacking

Penetration Testing 2 September 2025

The Real World Risk Score: Why Context Beats CVSS

CVSS tells you how bad a vulnerability is in theory. It doesn't tell you how bad it is in your environment, with your data, behind your controls, in the context of the attack chains your pen tester actually demonstrated. That's why we use the Real World Risk Score — a contextual severity model that rates findings by what they actually mean for your organisation, not what they'd mean in a vacuum.

CVSS risk scoring real world risk

Penetration Testing 26 August 2025

Vulnerability List vs Narrative Report: Why Context Is Everything

A vulnerability list tells you what's wrong. A narrative report tells you what happens when things go wrong — in what order, through which path, with what consequences, and what single change would have stopped it. One is a spreadsheet. The other is understanding. Here's why the difference matters more than most organisations realise.

reporting narrative risk context

Penetration Testing 19 August 2025

Translating Technical Findings into Business Risk

A pen test report that says 'Kerberoasting achieved Domain Admin via svc_backup' communicates everything to a security engineer and nothing to a board member. The same finding expressed as 'an attacker on our network can access every customer record, every financial document, and every email in the organisation within four hours — and our security systems won't detect it' communicates everything to a board member. Same finding. Different language. Different outcome.

business risk executive reporting board communication

Penetration Testing 12 August 2025

The Report Is the Deliverable, Not the Test

The penetration test has no value in isolation. The tester's knowledge evaporates when the engagement ends. The compromised systems are restored. The shells are closed. The only thing that persists — the only artefact that drives remediation, informs the board, satisfies the auditor, and changes the organisation's security posture — is the report. The report isn't a summary of the work. It IS the work.

reporting pen test deliverables ROI

penetration-testing guest-wifi network-segmentation

Case Study 5 August 2025

From Guest Wi-Fi to Sensitive Data

In the twentieth instalment of From the Hacker Desk, Hedgehog Security traces a path from a guest wireless network — intended to provide internet-only access for visitors — to sensitive corporate data, through a chain of misconfigured firewall rules, a shared print services VLAN, and an overlooked network bridge. The article dissects how assumptions about guest isolation frequently collapse under scrutiny and provides a methodology for validating that guest networks are genuinely isolated.

Penetration Testing 5 August 2025

What a Good Penetration Test Report Looks Like

The penetration test is only as valuable as the report it produces. A technically brilliant engagement that delivers an unreadable, jargon-dense, 200-page PDF has failed its intended audience. Here's what a good report looks like, why most reports fall short, and how to tell whether your provider's deliverable is worth the paper — or the screen — it's written on.

reporting pen test deliverables executive summary

Technical Deep Dive 29 July 2025

Fun and Frustrations with Pentesting AI Engines and Guardrails

What happens when you point a penetration tester at an LLM-powered application? Prompt injection, guardrail bypass, data leakage through context windows, and a testing methodology that breaks every assumption traditional pen testing was built on. Here's what we've learned — the fun bits, the frustrating bits, and why AI security testing is a discipline that doesn't quite exist yet.

AI security LLM prompt injection

Penetration Testing 22 July 2025

Why Detection Gaps Are More Valuable Than Vulnerabilities

A penetration test that reports 'Domain Admin achieved via Kerberoasting' gives you a vulnerability to fix. A penetration test that reports 'Domain Admin achieved via Kerberoasting — and your SOC detected none of the seven attacker actions across three hours' gives you a detection engineering programme. The second finding is worth more. Here's why.

detection engineering SOC SIEM

Technical Deep Dive 15 July 2025

Nmap: A Deep Dive for Vulnerability Scanning and Penetration Testing

Nmap is the most widely used network scanning tool in the world — and most people use about 10% of its capability. This deep dive covers everything from basic host discovery through advanced NSE scripting, service enumeration, OS fingerprinting, firewall evasion, and how professional penetration testers use Nmap as the foundation of every infrastructure engagement.

nmap network scanning vulnerability scanning

Penetration Testing 8 July 2025

Penetration Testing and Defensive Security: Complement, Not Competition

Penetration testing doesn't replace a SOC, EDR, or detection capability — and a mature defensive stack doesn't eliminate the need for penetration testing. They answer fundamentally different questions. Here's how they complement each other, where each exposes the other's blind spots, and why the organisations with the strongest security posture invest in both.

SOC EDR detection

penetration-testing password-cracking credential-security

Case Study 1 July 2025

Cracking 60% of Passwords in a Single Afternoon

In the nineteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how ARP poisoning, LLMNR/NBT-NS abuse, and NetNTLMv2 relay and capture — combined with offline hash cracking — yielded sixty per cent of an organisation's domain passwords in a single afternoon. The article examines why traditional password policies produce predictably weak passwords, why compliance-driven complexity rules create an illusion of security, and how modern passphrase strategies and technical controls can fundamentally change the economics of credential attacks.

Penetration Testing 1 July 2025

The Human Element of Penetration Testing

The most hardened perimeter, the most carefully configured cloud environment, and the most thoroughly tested application all share the same weakness: the people who use them. Here's how penetration testing exposes the human assumptions that attackers routinely exploit — and why technology alone will never be enough.

social engineering phishing human factors

Penetration Testing 24 June 2025

Testing SaaS Platforms and the Shared Responsibility Model

You can't port-scan Salesforce. You can't run Nmap against Microsoft 365. Modern SaaS penetration testing requires understanding shared responsibility models, tenant isolation boundaries, and configuration-level risk — not brute-force exploitation of infrastructure you don't own.

SaaS security shared responsibility tenant isolation

Technical Deep Dive 17 June 2025

NetNTLMv2 Hash Cracking and the Case Against Legacy Authentication

NetNTLMv2 hash capture and cracking is one of the most reliable attack techniques in internal penetration testing — and it works because enterprises continue to run authentication protocols designed in an era before the threats they now face existed. Here's how the attack works, why it's so effective, and what modern authentication should look like.

NTLM NetNTLMv2 authentication

Penetration Testing 3 June 2025

Cloud Penetration Testing

Cloud penetration testing isn't traditional infrastructure testing relocated to someone else's data centre. The attack surface is different, the rules are different, the methodology is different, and the misconceptions are everywhere. Here's what cloud testing actually involves — and what most organisations get wrong.

cloud security AWS Azure

penetration-testing cctv-security physical-security

Case Study 3 June 2025

Turning a CCTV System into an Intelligence Hub

In the eighteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a CCTV management interface — accessible from the corporate network with default credentials — became a reconnaissance goldmine, revealing network topology, stored credentials for adjacent systems, and administrative access to physical security infrastructure. The article explores why surveillance systems are consistently underestimated as attack surfaces and how their privileged network position makes them ideal pivot points.

Penetration Testing 3 June 2025

Privilege Escalation in Penetration Testing

Privilege escalation is the phase that transforms a minor foothold into a catastrophic compromise. Here's how it works across Windows, Linux, Active Directory, cloud, and web applications — and why it matters more than any single vulnerability in the report.

privilege escalation penetration testing Active Directory

Penetration Testing 27 May 2025

Identity, Authentication, and Access Control in Penetration Testing

Broken access control is the number one vulnerability class in the OWASP Top 10. Authentication flaws enable the majority of real-world breaches. And automated scanners miss almost all of them. Here's what penetration testing reveals about the identity layer that no tool can assess.

access control authentication identity

Penetration Testing 20 May 2025

Internal vs External Penetration Testing

External tests simulate an attacker trying to get in. Internal tests simulate what happens after they succeed. Here's how they differ, what each reveals about your security posture, and why the internal test almost always produces the findings that keep CISOs awake at night.

internal testing external testing lateral movement

Penetration Testing 13 May 2025

Responsible Proof of Concept in Penetration Testing

Proof-of-concept exploitation is what separates a credible penetration test from a theoretical exercise. But PoC that goes too far damages trust, and PoC that doesn't go far enough gets ignored. Here's how to get the balance right.

proof of concept penetration testing responsible disclosure

penetration-testing api-security web-application

Case Study 6 May 2025

Escalating Through Misconfigured API Endpoints

In the seventeenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how a modern web application with no traditional injection vulnerabilities was compromised through API logic flaws — broken object-level authorisation, mass assignment, and insecure direct object references. The article examines why the evolution from monolithic web applications to API-driven architectures has shifted the attack surface from code injection to authorisation logic, and why testing must evolve accordingly.

Penetration Testing 6 May 2025

What Exploitation Really Means in a Penetration Test

Exploitation in a professional pen test isn't about breaking things — it's about proving that an attacker could. Here's how testers balance realism with safety, why proof of impact changes the remediation conversation, and what responsible exploitation looks like in practice.

penetration testing exploitation proof of concept

Penetration Testing 29 April 2025

Chaining Low-Risk Findings Into High-Impact Compromise

Individual vulnerabilities rarely tell the full story. The most devastating breaches are built from chains of low- and medium-severity findings that, combined, deliver a result far worse than any single vulnerability alone.

vulnerability chaining penetration testing risk assessment

Penetration Testing 22 April 2025

Penetration Testing Methodology Walkthrough

A plain-English, step-by-step walkthrough of what actually happens during a professional penetration test — from the first scoping conversation through to the final retest — so you know exactly what you're commissioning and what to expect at every stage.

penetration testing methodology process

Penetration Testing 15 April 2025

Why Automated Tools Are Not Enough

Automated vulnerability scanners are fast, consistent, and essential — but they are fundamentally incapable of finding the vulnerabilities that lead to real breaches. Here's what they miss, why they miss it, and what skilled human testers bring that no tool can replicate.

penetration testing vulnerability scanning automation

Penetration Testing 8 April 2025

Attack Surface Mapping

How mapping the full attack surface — not just the assets you know about — informs test depth, prioritisation, and realistic exploitation paths. And why most organisations are testing less than half of what an attacker can see.

attack surface penetration testing asset discovery

penetration-testing social-engineering usb-security

Case Study 1 April 2025

The USB That Opened the Door

In the sixteenth instalment of From the Hacker Desk, Hedgehog Security recounts a controlled USB drop exercise that demonstrated how human curiosity consistently overrides security policy. The article analyses the technical and human dimensions of USB-based attacks, evaluates the effectiveness of endpoint execution policies and device control mechanisms, and examines what the results reveal about the gap between security awareness training and actual behaviour under real-world conditions.

Penetration Testing 1 April 2025

Reconnaissance and OSINT in Penetration Testing

Why modern attackers rarely begin with scanning tools — and how open-source intelligence gathering shapes every phase of a real attack, from target selection through to objective completion.

reconnaissance OSINT penetration testing

Penetration Testing 25 March 2025

How We Model Real-World Threat Scenarios

How we design penetration tests around genuine attacker behaviour rather than generic checklists — using threat intelligence, MITRE ATT&CK, and scenario-based modelling to ensure every engagement reflects the threats your organisation actually faces.

threat modelling MITRE ATT&CK red team

Penetration Testing 18 March 2025

Why Bad Scoping Is Worse Than No Testing

A penetration test with incorrect scoping doesn't just waste money — it actively makes you less safe by creating false confidence. Here's how scoping goes wrong and what to do about it.

penetration testing scoping risk management

12 min read

Penetration Testing 11 March 2025

What Happens Before a Penetration Test

The most important phase of a penetration test happens before any tool is launched. Scoping, rules of engagement, and getting your assumptions right determine whether the test delivers genuine insight or just generates noise.

penetration testing scoping rules of engagement

Security Strategy 10 March 2025

Why the Ultimate Goal of Penetration Testing Is Not to Find Flaws

Fifty-seven articles in this series have explored the techniques, the reports, the frameworks, the metrics, and the strategy of penetration testing. Each article focused on a specific aspect — from writing remediable findings to building multi-year programmes, from DORA compliance to choosing providers. But every article pointed toward the same truth: the purpose of a pen test is not to find vulnerabilities. Vulnerabilities are the means. The purpose is to enable better decisions at every level of the organisation — from the engineer who fixes the GPO to the board member who approves the investment. This final article brings the series together around that central idea.

decision-making resilience confidence

Penetration Testing 4 March 2025

Common Penetration Testing Types Explained

A plain-English guide to the most common types of penetration test — external, internal, web application, mobile, cloud, wireless, and social engineering — what each one covers, what it finds, and when you need it.

penetration testing web application testing social engineering

penetration-testing ics-security ot-security

Case Study 4 March 2025

Leveraging Default Credentials in Industrial Control Systems

In the fifteenth instalment of From the Hacker Desk, Hedgehog Security examines an engagement where an operational technology network retained manufacturer-default credentials on programmable logic controllers, human-machine interfaces, and engineering workstations. The article explores the unique challenges of testing ICS environments, the consequences of configuration inertia, and why the convergence of IT and OT networks demands a fundamentally different approach to security assessment.

Penetration Testing 25 February 2025

How Attackers Actually Think

Understanding the attacker mindset — how real adversaries approach a target, why they succeed, and how that understanding shapes effective penetration testing and smarter defence.

attacker mindset kill chain penetration testing

12 min read

Penetration Testing 18 February 2025

Compliance-Driven vs Threat-Led Penetration Testing

The difference between testing because a standard says you must and testing because you genuinely want to understand your risk — and why confusing the two leads to poor security decisions.

penetration testing compliance threat-led testing

11 min read

Penetration Testing 11 February 2025

Penetration Testing Is a Business Risk Exercise, Not Just a Technical One

Why the most valuable outcome of a penetration test isn't a list of CVEs — it's a clear understanding of what an attacker could do to your business, and what that would cost you.

penetration testing business risk risk management

9 min read

Case Study 4 February 2025

Breaking Into Wi-Fi from the Car Park

In the fourteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how corporate wireless networks were compromised from outside the building perimeter — from a vehicle in the car park. The article details modern wireless attack methodology including PMKID capture, WPA2 PSK cracking, evil twin attacks, and the exploitation of legacy wireless configurations, and explains the defensive controls that organisations frequently overlook.

penetration-testing wireless-security wifi-hacking

Penetration Testing 4 February 2025

An Introduction to Penetration Testing

What penetration testing is, what it is not, and why it exists as a discipline distinct from vulnerability scanning. A clear, jargon-light guide for decision-makers and technical teams alike.

penetration testing vulnerability scanning security fundamentals

10 min read

Attack Techniques 28 January 2025

Understanding Pass-the-Hash: How Attackers Exploit Password Vulnerabilities in Windows Environments

A comprehensive technical breakdown of the Pass-the-Hash attack technique. Covers how NTLM authentication works, why hashes are equivalent to passwords, how attackers extract and relay credentials, and what organisations must do to detect, mitigate, and prevent lateral movement through hash-based authentication abuse.

pass-the-hash ntlm lateral-movement

Penetration Testing 24 January 2025

Why Penetration Testing Remains Relevant Despite Advances in Automated Security Tooling and AI-Driven Detection

The sales pitch is compelling: deploy the AI-powered vulnerability scanner, enable the machine learning-driven EDR, activate the automated penetration testing platform, and eliminate the need for expensive human testers. The tools are impressive. The dashboards are reassuring. The coverage metrics are comprehensive. And the argument follows logically: if automation can scan every port, test every configuration, and detect every known vulnerability — why pay a human to do it? This article explains why — and why the organisations that replace human pen testing with automated tooling are making a decision they may not understand until the breach that automation didn't predict.

automation AI machine learning

Threat Intelligence 21 January 2025

APT39: A Closer Look at Iran's Cyber Espionage Operation Targeting Travel and Telecommunications

An in-depth examination of APT39 (Chafer), an Iranian state-sponsored threat group focused on surveillance and tracking of individuals through compromise of travel, telecommunications, and hospitality organisations. Covers attribution, tactics, techniques, infrastructure, detection opportunities, and what their operations mean for organisations in targeted sectors.

apt39 chafer iran

Security Strategy 17 January 2025

How Penetration Testing Differs from Red Teaming, and When Each Is Appropriate

The terms are used interchangeably — often by providers who offer both, and sometimes by providers who offer neither. A client asks for a red team engagement and receives a pen test with a different label. A CISO requests a pen test and is sold a red team exercise at three times the cost. The confusion isn't academic — it leads to organisations buying the wrong assessment for their maturity level, their objectives, and their budget. This article explains the fundamental differences between penetration testing and red teaming, when each approach produces the most value, and how purple teaming completes the picture.

red teaming purple teaming penetration testing

Threat Intelligence 14 January 2025

TeamViewer Hack — What You Need to Know and What to Do

A detailed analysis of the June 2024 TeamViewer corporate network breach attributed to APT29 (Midnight Blizzard). Covers what happened, how the attack was executed through a compromised employee account, what data was accessed, the transparency controversy, and what organisations using TeamViewer should do to protect themselves.

teamviewer apt29 midnight-blizzard

Threat Intelligence 7 January 2025

APT33: The Aerospace Stalker — Iran's IRGC-Linked Cyber Espionage Group Targeting Defence and Energy

An in-depth profile of APT33 (Elfin, Peach Sandstorm, Refined Kitten), an Iranian state-sponsored threat group linked to the Islamic Revolutionary Guard Corps. Covers their decade-long targeting of aerospace, defence, and energy sectors, evolving tradecraft from spear-phishing to cloud-based operations, custom malware including Tickler and FalseFont, and what organisations in targeted sectors must do to defend against persistent nation-state espionage.

apt33 elfin peach-sandstorm

Case Study 7 January 2025

When Backup Systems Became the Attack Vector

In the thirteenth instalment of From the Hacker Desk, Hedgehog Security demonstrates how backup appliances — implicitly trusted and rarely scrutinised — provided a direct path to an organisation's most sensitive data. Outdated firmware, exposed management interfaces, and default credentials on the backup infrastructure yielded access to full system images, database dumps, and Active Directory backups. The article argues that resilience systems must be treated as high-value targets deserving the same security rigour as the production systems they protect.

penetration-testing backup-security data-protection

Vulnerability Analysis 1 January 2025

CVE-2024-21410: Critical Microsoft Exchange NTLM Relay Vulnerability — What Happened, Why It Matters, and What to Do

A detailed technical analysis of CVE-2024-21410, the critical CVSS 9.8 privilege escalation vulnerability in Microsoft Exchange Server that was actively exploited as a zero-day. Covers the NTLM relay attack mechanism, affected systems, exploitation in the wild, remediation through Extended Protection for Authentication, and why this vulnerability exemplifies the systemic risk of NTLM in modern enterprise environments.

cve-2024-21410 exchange-server ntlm-relay

Defensive Security 25 December 2024

What Are Tarpits? Slowing Down Attackers by Wasting Their Time

A technical explanation of network tarpits and how they are used as a defensive technique to slow down port scanners, brute-force tools, spam bots, and automated attack infrastructure. Covers how tarpits work at the TCP level, common implementations including LaBrea, Endlessh, and modern HTTP tarpits, their role in a layered defence strategy, and the practical considerations for deployment in production environments.

tarpits defensive-security network-defence

Threat Intelligence 18 December 2024

APT42: Iran's Social Engineering Specialists — From Journalist Impersonation to Election Interference

An in-depth profile of APT42 (Charming Kitten, Mint Sandstorm, TA453), the IRGC Intelligence Organization's cyber espionage group specialising in surveillance of dissidents, journalists, academics, and political figures. Covers their world-class social engineering tradecraft, credential harvesting operations, mobile surveillance capabilities, the 2024 US presidential election hack, and what makes this group uniquely dangerous to individuals rather than infrastructure.

apt42 charming-kitten mint-sandstorm

Threat Intelligence 11 December 2024

APT12: The PRC's Cyber Operative — From the New York Times Hack to a Decade of Espionage Against East Asia

An in-depth profile of APT12 (Numbered Panda, IXESHE, DynCalc, Hexagon Typhoon), a Chinese People's Liberation Army-linked cyber espionage group targeting media organisations, governments, and high-technology companies across East Asia. Covers the 2012 New York Times breach, the group's custom malware families, their distinctive ability to rapidly evolve after public exposure, and why their sustained focus on Taiwan and Japan reflects the PRC's broader strategic objectives.

apt12 numbered-panda china

Threat Intelligence 4 December 2024

APT35: Iran's Long-Running Espionage Machine — From Fake Journalists to ProxyShell Exploitation

A comprehensive profile of APT35 (Charming Kitten, Magic Hound, Mint Sandstorm, Phosphorus), the IRGC-linked cyber espionage group conducting long-term, resource-intensive operations against government, military, diplomatic, media, and energy targets worldwide. Covers their evolution from social media manipulation to rapid vulnerability exploitation, their dual espionage-and-ransomware capability, custom malware including BellaCiao and PowerLess, and their relationship to APT42.

apt35 charming-kitten magic-hound

Case Study 3 December 2024

Abusing Cloud Permissions to Escalate Privileges

In the twelfth instalment of From the Hacker Desk, Hedgehog Security details how a misconfigured Azure custom role allowed privilege escalation from a low-privileged developer account to Global Administrator — without exploiting a single software vulnerability. The article traces the path through overpermissive role assignments, service principal abuse, and token manipulation, and examines why cloud IAM misconfigurations are the most prevalent and least understood class of risk in modern enterprise environments.

penetration-testing cloud-security azure

Threat Intelligence 27 November 2024

APT34: OilRig — Iran's DNS Tunnelling Specialists Targeting Critical Infrastructure Across the Middle East

A comprehensive profile of APT34 (OilRig, Helix Kitten, Earth Simnavaz, Crambus), an Iranian MOIS-linked cyber espionage group conducting sustained campaigns against government, energy, financial, and telecommunications sectors. Covers their signature DNS tunnelling C2 techniques, the catastrophic 2019 tool leak, their evolution from Helminth to cloud-integrated implants, supply chain attacks, the ZeroCleare destructive capability, and their remarkable persistence despite repeated public exposure.

apt34 oilrig helix-kitten

Threat Intelligence 20 November 2024

MuddyWater: Iran's MOIS Conglomerate — Turning Legitimate Admin Tools Into Espionage Weapons

A comprehensive profile of MuddyWater (Static Kitten, Mango Sandstorm, Mercury, Seedworm, TA450), the Iranian MOIS-subordinate cyber espionage conglomerate targeting government, telecoms, defence, and energy sectors across the Middle East, Europe, and beyond. Covers their signature abuse of legitimate RMM tools, the conglomerate structure of regionally focused sub-groups, the BugSleep and Phoenix backdoors, their PowerShell-heavy tradecraft, and why this group represents the living-off-the-land threat at scale.

muddywater static-kitten mango-sandstorm

Data Breaches 13 November 2024

Capgemini Data Breach: 20 GB of Sensitive Information Stolen — A Deeper Analysis of the Breach and What It Means for the Supply Chain

In September 2024, a threat actor using the alias 'grep' claimed to have compromised Capgemini's systems and exfiltrated 20 GB of sensitive data including source code, credentials, private keys, employee information, and T-Mobile virtual machine logs. We examine what was stolen, what it means for supply chain security, and what organisations should learn from the breach of a €22 billion IT services giant.

data-breach capgemini supply-chain

12 min read

Penetration Testing 6 November 2024

What Is a Threat-Led Penetration Test (TLPT)? — Intelligence-Driven Red Teaming Explained

A comprehensive guide to Threat-Led Penetration Testing (TLPT): what it is, how it differs from conventional penetration testing and red teaming, the frameworks behind it (TIBER-EU, CBEST, DORA), how the testing phases work, what a real TLPT scenario looks like, and why regulatory bodies now require intelligence-driven attack simulation for critical financial infrastructure.

tlpt threat-led-penetration-testing red-teaming

Case Study 5 November 2024

Social Engineering the Reception Desk

In the eleventh instalment of From the Hacker Desk, Hedgehog Security recounts a physical social engineering engagement where no technical exploitation was used. Through carefully constructed pretexts, open-source intelligence, and an understanding of human psychology, the team gained controlled access to internal areas including server rooms, executive offices, and restricted floors. The article examines human-layer vulnerabilities, the psychology behind successful social engineering, and why technical controls alone cannot defend against a determined adversary.

penetration-testing social-engineering physical-security

Threat Intelligence 30 October 2024

APT1: The Persistent Data Hoarder — How a PLA Unit Stole Hundreds of Terabytes and Changed Cyber Threat Intelligence Forever

A comprehensive profile of APT1 (Comment Crew, Unit 61398), the PLA cyber espionage group exposed by Mandiant's landmark 2013 report. Covers the group's industrial-scale theft of intellectual property from 141 organisations across 20 industries, the WEBC2 'Comment Crew' backdoor technique, the DOJ indictment of five PLA officers, and why the APT1 report remains the single most consequential publication in the history of cyber threat intelligence.

apt1 comment-crew unit-61398

Case Study 1 October 2024

The VLAN That Wasn't Really Segmented

In the tenth instalment of From the Hacker Desk, Hedgehog Security dissects an engagement where network segmentation existed in design documentation but was not enforced in practice. Misconfigured firewall rules, accumulated exceptions, and a lack of validation testing allowed unrestricted lateral movement between VLANs that should have been isolated. The article examines how segmentation failures occur, how they persist undetected, and how to validate them effectively.

penetration-testing network-segmentation firewall-rules

Case Study 3 September 2024

The Forgotten Test Server That Held the Crown Jewels

In the ninth instalment of From the Hacker Desk, Hedgehog Security describes how an overlooked development server — absent from the asset register and excluded from patching cycles — contained full production database backups including customer PII, financial records, and authentication credentials. The article explores asset management failures, shadow infrastructure, and the systemic risk of development environments that nobody owns.

penetration-testing asset-management shadow-it

penetration-testing endpoint-security asset-management

Case Study 6 August 2024

How an Intern's Laptop Became Our Beachhead

In the eighth instalment of From the Hacker Desk, Hedgehog Security demonstrates how inconsistent endpoint hardening across a corporate estate left a single under-managed device without modern EDR controls or current patching. The article traces how that device — assigned to a summer intern — became the foothold that undermined an otherwise mature security architecture and ultimately led to domain compromise.

penetration-testing vpn-security trust-relationships

Case Study 2 July 2024

Exploiting Trust Between Two Offices

In the seventh instalment of From the Hacker Desk, Hedgehog Security details how a site-to-site VPN established years prior created implicit trust between a hardened head office and a lightly secured satellite location. By compromising the weaker environment and pivoting through the tunnel, the team achieved domain-level access to the head office without ever setting foot in the building. The article analyses trust relationships, flat networks, and inherited risk.

penetration-testing iot-security firmware-analysis

Case Study 4 June 2024

Breaching the Network Through the Coffee Machine

In the sixth instalment of From the Hacker Desk, Hedgehog Security explains how an internet-enabled coffee machine installed for staff convenience exposed a poorly secured web interface on the corporate network. Through enumeration, firmware analysis, and credential extraction, the team demonstrated how consumer IoT embedded in corporate environments introduces systemic risk that traditional security controls cannot address.

penetration-testing phishing social-engineering

Case Study 7 May 2024

Phishing the Finance Director in 11 Minutes

In the fifth instalment of From the Hacker Desk, Hedgehog Security walks through a spear-phishing engagement that compromised a senior executive's Microsoft 365 account in under eleven minutes. The article details modern phishing tradecraft including adversary-in-the-middle token harvesting, session cookie replay, and conditional access bypass — demonstrating why multi-factor authentication must be implemented correctly to provide meaningful protection.

penetration-testing active-directory printer-security

Case Study 2 April 2024

When the Printer Became the Domain Administrator

In the fourth instalment of From the Hacker Desk, Hedgehog Security details how a multifunction printer with default credentials and exposed SMB shares yielded service account passwords that escalated into full Active Directory domain compromise. The article walks through credential extraction from embedded web interfaces, LDAP bind harvesting, and the systemic risk posed by devices that every organisation owns but few bother to secure.

penetration-testing maritime-security physical-security

Case Study 5 March 2024

A Paperclip, a Superyacht, and a Bypassed Keylock

In the third instalment of From the Hacker Desk, Hedgehog Security recounts how a physical keylock protecting a superyacht's satellite internet uplink cabinet was bypassed with a common office supply. The article explores the interplay between physical and cyber controls in maritime environments, and details how access to the connectivity stack exposed the vessel's entire network to compromise.

Case Study 6 February 2024

Turning the Lift into a Mobile Reconnaissance Platform

In the second instalment of From the Hacker Desk, Hedgehog Security examines how lift control software exposed diagnostic interfaces over an internal network during an OT-enabled building assessment. The article details how weak segmentation and insecure service configurations allowed the team to transform a lift car into a moving wireless survey and network discovery platform, exposing the dangerous convergence of Operational Technology and corporate IT.

penetration-testing operational-technology iot-security

Case Study 2 January 2024

Creating Our Own Access with the Boardroom TV

In the first instalment of From the Hacker Desk, Hedgehog Security describes how an unmanaged smart television in an executive boardroom became the entry point for complete Active Directory domain compromise during an internal penetration test. The article traces the full kill chain from passive reconnaissance through command injection, lateral movement, and credential harvesting to DCSync.

penetration-testing iot-security lateral-movement