Articles
Penetration testing
6 min
What a good penetration test report contains
A penetration test report serves three audiences with different needs: engineers who have to fix things, leadership who have to decide what matters, and auditors who have to evidence a control. A report that only serves one creates translation work after the engagement ends.
7 min
How to scope a penetration test without wasting half of it
Scope decides what a penetration test can find and what its report can be used to claim. The four decisions that matter are which systems, which environment, how much access the tester gets, and what is explicitly out of bounds.
7 min
AI-assisted penetration testing should make evidence easier, not more opaque
Automation is useful in security testing when it removes repetitive work while preserving accountable human judgment. It stops being useful when it turns the assessment into an unexplained score or a report with no defensible method behind it.
6 min
The pen test quote problem: why security buyers still cannot see the price
Penetration testing effort changes for knowable reasons: how much is in scope, how much context the tester gets, how fast evidence is needed, and whether testing continues after the report. A quote-only process does not make those inputs more accurate, it moves price discovery into a sales cycle.