ARTICLES

Notes
from the field.

What we find and what you can do about it. Notes from real tests.

LATEST ✚
2026-09-11Position · Ordering6 min read

Ordering is the easy part. Being ready to fix is the hard one.

What to ask before ordering a pentest, and what makes the findings possible to fix.read the article →
2026-08-30Position · Remediation

The report is not the product. The fixed flaw is.

Why findings go unfixed, and how a short, prioritised report helps small teams address them.read the article →
2026-07-28Method · [ AI ] [ HUMAN ]

Alone, the AI solves 21 percent. With a human beside it: 64.

What evaluations show about AI in security testing, and why findings need human review.read the article →
2026-07-24Findings · CVE

One pixel was enough. That is how an AI got into Bing.

Real AI findings in SQLite, OpenSSL, FreeBSD and Bing. And the false alarms that led curl to close its bounty programme.read the article →
2026-07-21Vulnerabilities · A01

The tool finds nothing wrong. Customer A still sees B's invoices.

A scanner does not know your access rules. It can miss customer A viewing customer B’s invoices.read the article →