Penetration testing for ISO 27001, SOC 2 and GDPR: what each actually requires
Do ISO 27001, SOC 2 and GDPR require a pentest? What each framework actually asks for, what auditors look for, and how one well-scoped test becomes…
Blog · Pentest Machine
Offensive security in practice: web, API and AI.
NIS2 and DORA penetration testing: what is required and what TLPT means
What NIS2 and DORA require for security testing, what TLPT (TIBER-EU) is, how often to test, and how to build a testing programme that survives an…
What is penetration testing? How it works and the types (black, grey and white box)
A complete guide to penetration testing: definition, phases, types by knowledge level (black, grey, white box) and by target, what a good report contains and how…
How much does a penetration test cost in 2026? Real price ranges and what drives them
Penetration testing cost by test type (web, API, AI, mobile) in the US and Europe, the 7 factors that move the price, red flags in cheap…
External Security X-Ray: see in 30s what an attacker sees of your company
We launched a free tool that passively analyses your domain's external security posture: email spoofing, HTTPS, subdomains, ports, public breaches and look-alike domains. Grade A–F and…
Free e-book: AI Security Pentest — how to test the security of AI applications
We've released a free technical guide on how to test the security of AI and LLM systems: prompt injection, RAG leakage, tool and agent abuse, jailbreaks,…
Why indie hackers, solopreneurs and vibe coders need a pentest
You shipped in weeks with AI writing the code, Stripe at checkout and auth out of the box. The catch: the flaws that sink small SaaS…
JWT and OAuth: the seven authentication mistakes that open the door without breaking the crypto
It's almost never the cryptography that fails — it's how the token is validated, where it's stored and what the OAuth flow trusts. The seven broken-authentication…
Scanner, pentest or bug bounty? What each one finds, what each one costs, and when to combine them
The three approaches don't compete — they cover different risks. A straight guide to deciding where to put your offensive security budget, with what each actually…
BOLA in APIs: why it is still the #1 finding and how we chain it into other customers’ data
Broken Object Level Authorization has led the OWASP API Top 10 for years and remains the most common critical finding in our API pentests. The mechanism,…