6 posts with this tag.
A penetration test produces one client-visible artifact. Not the scan logs. Not the exploitation notes. Not the hours of manual testing that identified findings the scanner missed. The client sees the …
Read more →The security industry is very good at producing people who know how to find vulnerabilities. It is considerably less focused on teaching those same people how to run a consultancy. If you are good at …
Read more →Every vulnerability scanner produces output that security practitioners can read and most clients cannot. A scan of a mid-size client environment returns hundreds of findings, organized by plugin ID, …
Read more →Some vulnerabilities are practically furniture. SSL weak cipher suites. Missing security headers. Insufficient account lockout policies. SMBv1 still enabled on a file server. If you have been doing …
Read more →The report is the deliverable. For most stakeholders, it is the only thing they will ever see from an engagement. The quality of your report shapes how your findings are received, how seriously …
Read more →An effective executive summary for a vulnerability assessment report communicates the overall security posture, highlights the most critical risks, and provides clear recommendations, all in one page …
Read more →