Pentest retest: what it is, why auditors expect it and how often to test
A retest proves the fix worked. Learn what it is, what the report must show, the most common fixing mistakes and how often to pentest.
Blog · Pentest Machine
Offensive security in practice: web, API and AI.
Pentesting and Brazil’s LGPD: what the ANPD expects from e-commerce and healthtech after an incident
An incident must be notified to Brazil's ANPD within 3 business days. See how a pentest becomes evidence of LGPD Article 46 security measures.
Anatomy of a pentest report: what it must contain (and how to spot a scanner dump)
From executive summary to retest: the eight parts of a good pentest report, the red flags of a scanner dump and a checklist for buyers.
SaaS pentest: how to answer ‘do you have a recent pentest?’ and close the enterprise deal
Enterprise security questionnaires ask for your latest pentest. Learn what to share, when to test, how to scope a SaaS and how to prove the retest.
PCI DSS 11.4 pentesting in practice: internal, external, segmentation and retest
PCI DSS 4.0.1 Requirement 11.4 has several sub-requirements and your QSA checks each one. CDE scoping, internal and external testing, segmentation, retesting and tester independence.
Mandatory pentesting for Central Bank of Brazil institutions: what BCB 538 and CMN 5,274 require
Independent penetration testing at least once a year. What BCB Resolution 538/2025 and CMN Resolution 5,274/2025 require, what the report must show and how to scope…
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what to do now about your PHP
Two critical flaws in the PHP core allow unauthenticated RCE and memory disclosure. Fixed versions, mitigations, secret rotation and an ordered checklist.
php2shell: how LFI, upload and filter chains turn into RCE in PHP
Defensive guide to php2shell: how LFI, insecure upload, phar and PHP filter chains turn into RCE, real CVEs and public tools to validate and fix.
Top penetration testing companies in Brazil (2026): comparing the 10 leading firms
A comparison of the 10 leading penetration testing companies in Brazil in 2026 — Pentest Machine, Tempest, Blaze, Conviso, Hakai, Pride, Clavis, Morphus, ISH and Strong…
API penetration testing: a guide to the OWASP API Security Top 10, scoping and preparation
How API penetration testing works (REST, GraphQL, gRPC): the OWASP API Security Top 10 as a coverage map, how to scope, what to hand the testers…