7 posts with this tag.
A penetration test produces one client-visible artifact. Not the scan logs. Not the exploitation notes. Not the hours of manual testing that identified findings the scanner missed. The client sees the …
Read more →The security industry is very good at producing people who know how to find vulnerabilities. It is considerably less focused on teaching those same people how to run a consultancy. If you are good at …
Read more →Some vulnerabilities are practically furniture. SSL weak cipher suites. Missing security headers. Insufficient account lockout policies. SMBv1 still enabled on a file server. If you have been doing …
Read more →Running a Nessus scan is the easy part. What happens next is where most teams lose time. The scan produces a list of findings. Someone has to decide which ones are real, which are noise, which need to …
Read more →Nessus is excellent at scanning. What it produces when it is finished is not a report. It is a list of findings, organized by plugin and severity, with remediation guidance attached. That output is …
Read more →Twenty-five years is an eternity in cybersecurity. Products get acquired, deprecated, replaced by the next generation of something, or simply abandoned while the industry moves on. Nessus has been in …
Read more →Most ticketing systems accept email. This single fact makes the entire API integration question considerably less important than it first appears. The common assumption when trying to route Nessus …
Read more →