Patterns we see. Mistakes that keep showing up. New attack surfaces worth tracking. Written by the engineers who run the engagements, not a marketing team.
The first management-system standard for AI. How it maps to ISO 27001, the impact assessment it adds, and where security testing provides evidence.
Sorted by publish date. Click a topic chip above to filter.
Risk tiers in practice, the dates that matter, and where the AI Act and GDPR overlap. Written for engineers, not lawyers.
What an AI pentest actually tests: model, prompts, tools, and the agent loop. The failures we keep finding and the controls that hold.
The format has tightened. Six examples of what passes review, what gets flagged, and what your engineering team can prepare ahead of fieldwork.
Indirect injection via documents, tool-use abuse, MCP server exposure. Notes from twelve AI security engagements over the last quarter.
ADCS misconfigurations still account for a third of the internal escalation paths we find. Why fixes stall and the four configuration changes that close most of them.
Self-hosted runners shared across repos are a quiet compromise path. A walk through one engagement and the policy changes that closed it.
Scoping a red team by asset list misses the point. Five objective patterns that produce engagements your CISO can take to the board.
The same five mistakes appear in every cloud audit. Each one has a fix that takes a sprint.
No articles match that topic yet. Pick another, or choose All.
Attestation letter, penetration test report, cardholder data environment, prompt injection, purple team, threat modeling, proof of concept. Plain-language definitions written by the engineers who test for them.