Compliance

Pentest retest: what it is, why auditors expect it and how often to test

A retest proves the fix worked. Learn what it is, what the report must show, the most common fixing mistakes and how often to pentest.

Pentesting and Brazil’s LGPD: what the ANPD expects from e-commerce and healthtech after an incident

An incident must be notified to Brazil's ANPD within 3 business days. See how a pentest becomes evidence of LGPD Article 46 security measures.

Anatomy of a pentest report: what it must contain (and how to spot a scanner dump)

From executive summary to retest: the eight parts of a good pentest report, the red flags of a scanner dump and a checklist for buyers.

SaaS pentest: how to answer ‘do you have a recent pentest?’ and close the enterprise deal

Enterprise security questionnaires ask for your latest pentest. Learn what to share, when to test, how to scope a SaaS and how to prove the retest.

PCI DSS 11.4 pentesting in practice: internal, external, segmentation and retest

PCI DSS 4.0.1 Requirement 11.4 has several sub-requirements and your QSA checks each one. CDE scoping, internal and external testing, segmentation, retesting and tester independence.

Mandatory pentesting for Central Bank of Brazil institutions: what BCB 538 and CMN 5,274 require

Independent penetration testing at least once a year. What BCB Resolution 538/2025 and CMN Resolution 5,274/2025 require, what the report must show and how to scope…

Penetration testing for ISO 27001, SOC 2 and GDPR: what each actually requires

Do ISO 27001, SOC 2 and GDPR require a pentest? What each framework actually asks for, what auditors look for, and how one well-scoped test becomes…

NIS2 and DORA penetration testing: what is required and what TLPT means

What NIS2 and DORA require for security testing, what TLPT (TIBER-EU) is, how often to test, and how to build a testing programme that survives an…

How much does a penetration test cost in 2026? Real price ranges and what drives them

Penetration testing cost by test type (web, API, AI, mobile) in the US and Europe, the 7 factors that move the price, red flags in cheap…

Pentesting for PCI DSS 4.0: what the auditor actually expects from your report

Buying a pentest "for compliance" and failing the audit anyway is more common than it looks. What changed in PCI DSS 4.0 and what a report…