Resources / Blog

Research & engineering notes.

How we think about autonomous offensive security, LLM risk, and running a red team at machine speed.

FIGScored one by one, each finding lands in the backlog. Scored as a path, the same three findings are the first thing to fix.

MethodologyOct 20, 2026·6 min

Attack Chains: Why Three Low-Severity Findings Can Add Up to a Critical

Severity scores rate findings one at a time. Attackers do not. Here is how three "low" issues become one critical, and how to triage for it.

FIG.01Three individually low-severity findings, chained by autonomous agents into one validated critical attack path.

ProductAug 4, 2026·8 min

What Is Agentic Penetration Testing? A Practical Guide

Why chaining autonomous reasoning agents finds attack paths that scanners and one-off pentests miss, and how validation keeps it safe.

FIGThe LLM risk categories we test most — each maps to an access-control, output-handling, or scoping decision teams already know how to make.

LLM SecurityJul 22, 2026·10 min

OWASP Top 10 for LLM Applications: What Security Teams Need to Know

A practitioner's walkthrough of the OWASP LLM risk categories, with concrete examples of how each shows up in production.

FIG.03A point-in-time pentest leaves every deploy after it untested; continuous testing re-validates on each change.

MethodologyJul 9, 2026·7 min

Continuous Attack Surface Management: Why Point-in-Time Pentests Aren't Enough

Production changes weekly. Your security testing cadence probably doesn't. Here's what closing that gap actually requires.

Newsletter

Get new research
in your inbox.

No spam, just what we're finding, roughly monthly.