Learn
Reference material for people who have to defend something real: definitions, regulations, comparisons and templates. Also see the full glossary and our research.
Glossary
Definitions with enough depth to act on.
- Prompt injectionPrompt injection explained for security teams: how direct and indirect injection work, real attack patterns against agents and RAG systems, why it ranks LLM01 in the OWASP Top 10, and which defenses hold up.
- MCP tool poisoningHow tool poisoning attacks hide instructions in MCP tool descriptions and schemas, why agents obey them, and a practical control list for teams connecting agents to MCP servers.
- CTEM (Continuous Threat Exposure Management)CTEM defined: Gartner's five-stage program (scoping, discovery, prioritization, validation, mobilization), what each stage produces, metrics per stage, and where it fails.
- Breakout timeBreakout time is how long an intruder takes to move from initial access to other systems. CrowdStrike measured a 48-minute eCrime average in 2024 and a fastest case of 51 seconds. What it means for detection and response targets.
Compliance & standards
What the rules actually require, requirement by requirement.
- OWASP Top 10 for LLM Applications (2025)All ten 2025 OWASP LLM risks — from LLM01 Prompt Injection to LLM10 Unbounded Consumption — with one concrete test case each and what a finding looks like.
- PCI DSS 4.0 penetration testing requirements (11.4)What PCI DSS v4.0/4.0.1 Requirement 11.4 requires: methodology, annual internal and external tests, retesting of exploitable findings, segmentation testing every 12 months (6 for service providers), and how continuous testing fits.
- DORA threat-led penetration testing (TLPT)DORA Article 26 TLPT explained: which financial entities must test, the at-least-every-three-years cycle, the TLPT RTS (Delegated Regulation (EU) 2025/1190), TIBER-EU alignment, and how to prepare.
- SEC 8-K Item 1.05 cyber incident disclosureHow the SEC's 2023 cybersecurity disclosure rule works: four business days from the materiality determination, what Item 1.05 requires, the national security delay, and what your incident process must produce.
- NIS2 incident reporting: 24h, 72h, one monthNIS2 Article 23 reporting explained: the 24-hour early warning, 72-hour incident notification, intermediate reports and one-month final report, what each must contain, and how to run the clocks.
Comparisons
Side-by-side, with the trade-offs.
- Autonomous pentesting vs breach and attack simulation (BAS)BAS replays known techniques to test controls; autonomous pentesting discovers and exploits new attack paths. A side-by-side on method, coverage, safety, output and when to use each.
- EPSS vs CVSSCVSS rates how severe a vulnerability is; EPSS estimates the probability it will be exploited in the next 30 days. How they differ, how to combine them, and why neither sees attack paths.
- AI SOC agent vs SOARSOAR executes predefined playbooks; an AI SOC agent decides what to investigate. Differences in coverage, maintenance, failure modes and governance, and how they work together.
Templates & checklists
Copy, adapt, bookmark.
- Penetration testing cost: a model, not a rangePrice ranges don't help you budget. A simple cost model — tester-days, coverage, retests and cadence — with worked numbers for consultancy, PTaaS and continuous testing, and breach-cost context.
- Penetration testing rules of engagement templateA copy-ready rules of engagement template for penetration tests and autonomous testing: scope, exclusions, windows, techniques, data handling, stop conditions, communications and sign-off.
- Incident response checklist (first 72 hours)A bookmarkable incident response checklist organized by clock time — first 15 minutes, first hour, first day, 72 hours — with SEC 8-K, NIS2 and GDPR reporting clocks built in.
Field guides
Long-form pillars for each topic.
- Autonomous penetration testingWhat autonomous penetration testing is, how AI pentesting agents actually work, where they beat human testers and scanners, and the 12 questions to ask any vendor before you buy.
- AI red teaming for LLM apps & agentsA practical guide to AI red teaming: threat models for LLM apps and autonomous agents, prompt injection and tool-abuse testing, OWASP LLM Top 10 and MITRE ATLAS mapping, and how to run it continuously.
- Continuous vs annual pentestingContinuous penetration testing compared with annual pentests and PTaaS: coverage, cost, compliance, time-to-detect and how to make the switch without breaking audit evidence.
- AI SOC analysts & agentsHow AI SOC analysts and autonomous SOC agents investigate alerts, what they can safely automate, how to measure accuracy, and a practical evaluation plan for security operations leaders.
- Adversarial exposure validation & CTEMWhat adversarial exposure validation (AEV) is, how it fits a Continuous Threat Exposure Management (CTEM) program, and how CISOs use it to prioritise risk and report exposure to the board.
Find out what bad AI finds.
A 30-minute briefing with an operator. We'll scope a first engagement against one real system of yours and show you the findings format before you sign anything.