Resources
Findings from our own engagements with the data and the method attached, the methodologies we run so you can hold us to them, and the tools we built because we kept needing them. One thing on this site sits behind a form, and it is marked as such.
Showing 4 of 12 resources in insights.Clear filter
Closing instances of a bug class does nothing about the class. On one platform authorisation was decided in 40 places and no engineer could enumerate them. The fix that worked was not a code review — it was a typed helper plus a lint rule that makes the insecure call impossible to write.
Nineteen months of green dashboards, a dump that excluded a schema added in 2023 because the script enumerated from a list written in 2019, and a service that could not start from it. A control that has never been executed is a hypothesis — here is how to test the four that matter.
The scope had been drawn around the whole organisation instead of the service that needed the certificate, which multiplied 61 applicable controls into 142 across business units with no involvement in it. Scope is the first decision and the most expensive one to get wrong.
A red team against an estate that has never had a penetration test will find the unauthenticated file upload at red team rates and teach you nothing about your detection, because the engagement ended at the first open door. What to buy first, and how to tell when you are ready.
Tools we use on engagements, released because they are more useful shared.
Buying questions — pricing, scoping, which thing to buy first — sit inside the service tree rather than here. Start at services.