[ 01 ] — Resources — Blog
Notes from the attacker's side.
Research, field notes and playbooks from our researchers and analysts.
AI
AI in offensive security: what it does well, and where humans still win
AI is changing how vulnerabilities are triaged, prioritised and fixed. It is not replacing the people who find them. Here is the honest split.
Strategy
Exposure debt: why finding fast and fixing slow is the real risk
A validated vulnerability that stays open is a liability you already know about. Here is how to measure it and pay it down.
AI Security
Prompt injection: what actually works against AI features, and what stops it
The techniques testers use against production language-model features — and the defences that hold up.
Hackers
Writing reports triagers love
A researcher's guide to getting reports validated faster and rewarded fairly.
Compliance
Vulnerability disclosure is becoming a legal expectation
How the EU Cyber Resilience Act and similar rules are turning a disclosure policy into a requirement for many vendors.
Guide
Bug bounty vs penetration testing: which do you need?
They answer different questions. A pentest proves a scope was tested methodically; a bug bounty keeps finding what everyone else missed. Here is how to choose — and when to use both.
Guide
How to set up a vulnerability disclosure program (VDP)
A practical, step-by-step guide to publishing a disclosure policy, choosing a reporting channel and handling the first reports well.
Guide
What is PTaaS (penetration testing as a service)?
PTaaS keeps the methodology of a traditional pentest but changes how it is bought, delivered and acted on. Here is what that means in practice.
Guide
How much does a bug bounty program cost?
Bug bounty cost has two parts — the platform and the rewards — and you control most of it. Here is how to think about budget without guessing.
Researchers
How to start bug bounty hunting with no experience
A realistic path from zero to a first accepted report: what to learn, how to practise legally, and how to pick your first target.
[ ∞ ] — Next step