10 questions to ask before hiring a pentest (and the answers that disqualify a vendor)
Pentest proposals look identical on paper and range from $5k to $60k. These ten questions separate manual testing from a scanner with a logo, and keep…
Blog · Pentest Machine
Offensive security in practice: web, API and AI.
Your AI agent has the database key. Who else does?
Agents with function calling and MCP turned the chatbot into a privileged user of your system. The five abuse patterns we find in agent pentests and…
Pentesting for PCI DSS 4.0: what the auditor actually expects from your report
Buying a pentest "for compliance" and failing the audit anyway is more common than it looks. What changed in PCI DSS 4.0 and what a report…
Indirect prompt injection in RAG: how a PDF becomes an attack on your assistant
The most common vector we find in AI pentests doesn't come from the user — it comes from the documents your assistant reads. Here's the mechanism,…