Your partner who provides transparency in cybersecurity.
Joined February 2009
- Tweets 3,593
- Following 360
- Followers 171
- Likes 46
2,060 Photos and videos
Mar 26
Hot take: Most organizations are testing the wrong things at the wrong time.
They pen test their production environment right before a major launch when they can't afford to find anything critical.
1
1
Mar 26
They test applications after they're deployed when changes are expensive and disruptive.
They test annually on a calendar schedule regardless of what actually changed in their environment.
Disagree with me. Or tell me I'm right. Either way, let's talk about it.
1
Mar 26
When SHOULD organizations be pen testing? What's the ideal timing and trigger?
Mar 19
Someone just asked us: "What's the fastest you've ever compromised a network during a pen test?"
Answer: 6 minutes.
Default admin credentials on an internet-facing admin panel. Took longer to set up the VPN than to get in.
1
3
Mar 19
Security folks: What's YOUR record? Not to brag, but to highlight how often the "sophisticated attack" is actually just trying admin/admin.
Share your fastest compromise story. Bonus points if it was embarrassingly simple.
Mar 12
Fill in the blank:
"The most frustrating part of working in cybersecurity is ___________."
We'll go first: Watching organizations ignore clear warnings until AFTER the breach, then suddenly having unlimited budget to fix everything.
Your turn.
1
8
Mar 12
What drives you crazy about this industry?
(And yes, venting is therapeutic. Let's hear it.)
7
Mar 10
We just cracked 67% of employee passwords during a pen test.
The client was stunned. They had "strict" password requirements: 12 characters, uppercase, lowercase, numbers, symbols, changed every 90 days.
Here's what everyone was actually using:
Summer2024!
Fall2024!
1
7
Mar 10
When you force frequent changes, people increment numbers. When you require symbols, they tack them on the end. When you make it painful, they write it down.
Swipe through to see what actually creates strong passwords (and what doesn't) →
1
2
Mar 10
Have you ever created a "compliant" password that you knew was terrible? You're not alone.
#CyberSecurity #PenTesting #InfoSec #PasswordSecurity #SecurityTips
28
Mar 5
Honest question for security leaders:
Would you rather find 100 vulnerabilities you can't fix, or 5 vulnerabilities you can actually address?
We see organizations obsess over comprehensive testing that generates massive reports, then get overwhelmed and fix nothing.
1
5
Mar 5
Meanwhile, focused testing on specific high-risk areas leads to actual remediation.
What's your take? Comprehensive scope or targeted testing?
There's probably no right answer, but we'd love to hear different perspectives on this.
Mar 4
"Won't telling you about known vulnerabilities make the pen test less valuable?"
We get asked this before almost every engagement.
The answer: No. It makes it MORE valuable.
1
2
Mar 4
It's about using your testing budget efficiently to find NEW problems while accounting for ones you're already managing.
The best pen tests happen when there's transparency and partnership, not when we're trying to "catch" you with findings you already know exist.
1
5
Mar 4
Swipe through to see why this approach saves time and money →
What's stopped your organization from being fully transparent with pen testers?
#CyberSecurity #PenTesting #InfoSec #SecurityTesting #ITSecurity
3
Mar 3
A client called us in a panic last month. They'd just patched a critical vulnerability on their web server, and suddenly their application stopped working.
Customers couldn't log in, transactions were failing, and revenue was dropping by the minute.
They rolled back the patch.
1
9
Mar 3
Everything worked again. And now they were stuck with a choice: security or functionality.
Swipe to see:
Why patching is more complicated than it sounds.
The approach that actually works.
Sometimes the most secure decision is to patch carefully rather than patch quickly.
1
1
Mar 3
Have you ever had a patch break something critical? How did you handle it?