Plain explanations of how testing and compliance actually work, written for the people who have to buy it, scope it or fix what it finds. Every number here comes with the report it came from, and where the reports disagree, we say so.
NCA ECC-2:2024 says “periodically”, not annually. SAMA 3.2.4 says annual. The UAE Central Bank changed the rules last month. Clause by clause, with the CREST question answered honestly.
Read it
They answer different questions and need different things in place first. We turn down more red team enquiries than we accept, and this is why.
Read it
Nobody publishes prices, including us. But what the number is made of is not a secret - and there are five things in a quote that should make you walk away.
Read it
There is a widely shared post claiming SBP and SECP jointly mandated annual penetration testing. We could not verify it. Here is what the real circulars say, clause by clause.
Read it
Authenticated internal scanning, a script inventory for your payment page, six-monthly segmentation testing for service providers - and the SAQ A trap that can double your assessment.
Read it
Verizon says software exploitation is surging. Sophos says it halved. Both are honest, and the disagreement tells you more than either number on its own.
Read it
Prompt injection through an HTTP header. A zero-click leak out of Microsoft 365 Copilot. What belongs in the scope of an AI penetration test, taken from OWASP rather than from anyone’s marketing.
Read it
One percent of S3 buckets are public. Fifty-nine percent of AWS IAM users have a key older than a year, and half of GKE clusters answer the internet. The risk moved.
Read it
The sections that make a pentest report useful to the people who have to fix things - and the padding that wastes everyone’s time.
Read it
Both have their place, and they answer completely different questions. Knowing which one you are buying matters.
Read it
How much you tell the tester changes what you learn, what it costs, and how long it takes.
Read itNothing under that subject yet.
More as we write them. If there is something you would like explained, ask us and we will put it on the list.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.