compliance

Pentesting and Brazil’s LGPD: what the ANPD expects from e-commerce and healthtech after an incident

An incident must be notified to Brazil's ANPD within 3 business days. See how a pentest becomes evidence of LGPD Article 46 security measures.

Anatomy of a pentest report: what it must contain (and how to spot a scanner dump)

From executive summary to retest: the eight parts of a good pentest report, the red flags of a scanner dump and a checklist for buyers.

PCI DSS 11.4 pentesting in practice: internal, external, segmentation and retest

PCI DSS 4.0.1 Requirement 11.4 has several sub-requirements and your QSA checks each one. CDE scoping, internal and external testing, segmentation, retesting and tester independence.

Mandatory pentesting for Central Bank of Brazil institutions: what BCB 538 and CMN 5,274 require

Independent penetration testing at least once a year. What BCB Resolution 538/2025 and CMN Resolution 5,274/2025 require, what the report must show and how to scope…

Penetration testing for ISO 27001, SOC 2 and GDPR: what each actually requires

Do ISO 27001, SOC 2 and GDPR require a pentest? What each framework actually asks for, what auditors look for, and how one well-scoped test becomes…

NIS2 and DORA penetration testing: what is required and what TLPT means

What NIS2 and DORA require for security testing, what TLPT (TIBER-EU) is, how often to test, and how to build a testing programme that survives an…

Pentesting for PCI DSS 4.0: what the auditor actually expects from your report

Buying a pentest "for compliance" and failing the audit anyway is more common than it looks. What changed in PCI DSS 4.0 and what a report…