Patterns we see. Mistakes that keep showing up. New attack surfaces worth tracking. Written by the engineers who run the engagements, not a marketing team.
The format has tightened. Six examples of what passes review, what gets flagged, and what your engineering team can prepare ahead of fieldwork.
Sorted by publish date. Click a topic chip above to filter.
Indirect injection via documents, tool-use abuse, MCP server exposure. Notes from twelve AI security engagements over the last quarter.
ADCS misconfigurations still account for a third of the internal escalation paths we find. Why fixes stall and the four configuration changes that close most of them.
Self-hosted runners shared across repos are a quiet compromise path. A walk through one engagement and the policy changes that closed it.
Scoping a red team by asset list misses the point. Five objective patterns that produce engagements your CISO can take to the board.
The same five mistakes appear in every cloud audit. Each one has a fix that takes a sprint.
Attestation letter, penetration test report, cardholder data environment, prompt injection, purple team, threat modeling, proof of concept. Plain-language definitions written by the engineers who test for them.