Technical team continuity: who can operate when the specialist is away?
Use the PERM announcement as a prompt to review dependence on individuals, without inferring risk from a worker's nationality.
Blog
Практические руководства по пентесту, исследованию уязвимостей и инструментам безопасности на базе ИИ.
Статьи публикуются на английском и португальском языках.
Статьи
150 публикаций
GhostAction on GitHub Actions: protecting secrets and reviewing workflows
An automation with a security label can still carry dangerous behavior. Our analysis proposes authorized tests for workflow changes, secret exposure and runner boundaries.
Meta VR Glasses: enterprise security and privacy
What to assess before bringing virtual reality to work: data capture, accounts, AI and APIs. Check the announcement details and Pentesty's original checklist for an enterprise pilot.
Cybersecurity Startups: The Application Security Opportunity
NFX sees an opening for security startups as software changes. Our analysis turns that thesis into a practical evidence checklist for evaluating application security, AI integrations and pentest providers.
OpenAI Safety Guardrails: What to Test Before Trusting an AI Agent
Six misalignment reports raise a practical security question: what can an agent actually do? Explore a reusable checklist for permissions, data exposure, memory and independent evidence.
The Future of Security Compliance Is AI-Native
Y Combinator named AI-Native Compliance Infrastructure a Fall 2026 Request for Startups. Why pentesting is the workflow most ready for that shift, how continuous assessment turns SOC 2, ISO 27001 and PCI DSS evidence into a byproduct instead of a project, and what changes when the security loop runs at the speed of deploys.
The AI “Super Bubble” Warning Is a Filter, Not a Funeral
Two of China's most respected hedge fund managers called the global AI rally a super bubble. Here is why that warning is actually good news for security and what a correction would do to the companies running on narrative versus the ones solving real problems.
Frontier AI Just Got Better at Hacking. Here's What That Means for Your Security Posture
OpenAI previewed GPT-5.6 Sol, their most capable model for cybersecurity yet. Exploitation primitives in Chromium and Firefox, U.S. government gating, and why the attacker-defender symmetry means continuous testing is no longer optional.
Novo Nordisk Breach: How a Leaked GitHub Token Exposed the Exact Ozempic Formula
FulcrumSec claims 1.3 TB stolen from Novo Nordisk, including source code, the exact Ozempic formula and clinical trial data on roughly 11,500 patients. Initial access came from one GitHub token, two months of dwell time, and a lot of lessons every engineering org should take from it.