Your web application passed a penetration test two years ago. Does that mean it is still secure today? Not necessarily. AI is changing how attackers discover vulnerabilities, analyse applications and automate attacks. Activities that once required significant technical expertise and manual effort can now be accelerated with AI-assisted tools. For organisations running legacy web applications,…
Not all web security assessments provide the same level of assurance. A Web Vulnerability Assessment (VA) typically focuses on identifying potential security weaknesses, often using automated scanning tools. A Web Application Penetration Test (PT) goes further by investigating whether vulnerabilities can be exploited and assessing their potential impact. However, some penetration testing services rely heavily…
Modern web applications increasingly use Single Page Application (SPA) architectures, where the browser communicates with backend services through APIs. These APIs handle everything from retrieving customer information to processing transactions and enforcing business rules. Yet many organisations assume that API penetration testing is unnecessary if their APIs are used only by their own web application,…
AI-powered chatbots and conversational assistants are becoming increasingly common in websites and business applications. They can answer customer questions, provide product information, assist employees and handle conversations automatically. But unlike traditional applications, these systems interpret natural language as instructions. This creates a new security risk known as LLM injection or prompt injection. What Is LLM…
Modern applications are no longer built from scratch. Today, it is common for applications to rely on services such as Clerk or Auth0 for authentication, AWS for cloud infrastructure, GraphQL for APIs, Stripe for payments, and various third-party SaaS platforms and APIs. These services are generally mature and have dedicated security teams. Developers can rely…
“But we already implemented that.” This is something we occasionally hear after reporting a vulnerability. The development team checks the application and confirms: The button is hidden. The option is disabled. The user cannot perform that action through the GUI. So why is there a vulnerabilty? Yes — the control may already exist in the…
Single Page Applications (SPAs) have become increasingly popular for modern web applications. Frameworks such as React, Angular, and Vue allow developers to build fast, interactive applications that communicate extensively with backend APIs. However, an SPA also introduces a different security attack surface. Much of the application’s logic is handled by JavaScript running in the user’s…
Every second, fintech platforms process high-value transactions, store sensitive financial data and connect with multiple third-party services through APIs. This makes them one of the most attractive targets for cybercriminals. Unlike traditional web applications, fintech platforms aren’t just protecting customer information—they’re protecting money. A single weakness in access control, business logic or authentication can result…
For many businesses—cafés, hotels, or even corporate offices—offering free guest Wi-Fi is a standard courtesy. It keeps customers happy and visitors productive. However, if not configured correctly, that “friendly” guest network can act as a digital back door straight into your company’s most sensitive data. In this post, we’ll explore the dangers of “Guest-to-Internal” pivoting…
Your firewall stopped the attack. Or so you thought. The breach that makes headlines is rarely the firewall being blown apart in a blaze of technical wizardry. More often, an attacker slips in quietly — through a phishing email, a misconfigured VPN, or a weak password on a remote desktop port — and then they…