Threat research
What 1,728 exploited flaws say about patch priorities
Our analysis of CISA's Known Exploited Vulnerabilities catalog: the vendors, flaw types and devices attackers use, and what it means for patching.
· 8 min read
// Blog
Security, explained plainly
Research-based writing on penetration testing, application and network security, compliance and cryptography. Every claim links to its source.
-
-
Web & API security
JWT security: seven mistakes that break token authentication
Seven JSON Web Token mistakes that let attackers forge or reuse tokens, from alg none and key confusion to weak secrets, and the RFC 8725 fixes.
· 5 min read
-
Compliance
SOC 2, ISO 27001 and PCI DSS: what each requires from a pentest
What SOC 2, ISO 27001 and PCI DSS v4.0.1 actually say about penetration testing: which require it, how often, who may test, and the evidence auditors ask for.
· 6 min read
-
Web & API security
Broken access control: why IDOR and BOLA top every list
Why broken access control is the number one web risk in OWASP data, how IDOR and BOLA flaws lead to real breaches, why scanners miss them, and how to fix them.
· 6 min read
-
Penetration testing
What's in a penetration test report (and how to read one)
A section-by-section guide to pentest reports (executive summary, scope, severity ratings, findings and retests) and how to turn one into a fix plan.
· 5 min read
-
Penetration testing
How much does a penetration test cost? What drives the price
What penetration tests cost in 2026 by test type, how quotes are built from days and day rates, what drives the price, and how to spot a scan sold as a pentest.
· 5 min read
-
Penetration testing
Penetration testing vs vulnerability scanning: the difference
Vulnerability scans and penetration tests find different things. Learn how each works, what each misses, and which one your business actually needs.
· 5 min read
-
Cryptography
Twofish encryption: how it works and when to use it
How the Twofish cipher works, why it lost the AES competition without being broken, what cryptanalysis has found since, and when AES is the better choice.
· 5 min read
-
Cryptography
Blowfish encryption: how it works and is it still secure?
How the Blowfish cipher works, why its 64-bit block rules it out for bulk encryption, why bcrypt still depends on it, and when to migrate to AES.
· 6 min read
-
Cryptography
AES vs DES: key differences, security and which to use
AES vs DES compared on key size, block size, structure, speed and compliance, with the public record of how DES was broken and how to find DES still in use.
· 6 min read
-
Network security
Triple DES (3DES): how it works and why it's being retired
How Triple DES works, why its 64-bit block led to the Sweet32 attack and its retirement, and how to remove the 3DES cipher suites that vulnerability scans flag.
· 6 min read
-
Cryptography
AES encryption explained: how it works and how to use it
How AES works, what 25 years of cryptanalysis found, which modes to use, and the mistakes (nonce reuse, padding oracles, hardcoded keys) that break it.
· 7 min read
-
Network security
What is the Data Encryption Standard (DES)? How it works
How DES works, why its 56-bit key failed in public, and where DES still hides in real networks: LM hashes, NTLMv1, Kerberos settings and SNMPv3.
· 6 min read
-
Cryptography
Symmetric vs asymmetric encryption: the key differences
Symmetric vs asymmetric encryption: how each works, why their key lengths are not comparable, how TLS combines both, and what post-quantum standards change.
· 5 min read
-
Cryptography
What is symmetric encryption? How it works, with examples
How symmetric encryption works, the main block and stream ciphers, why modes and nonces matter, and the practices that keep a shared key from becoming a breach.
· 5 min read