Technical write-ups from the PXLSec team: offensive-security methodology, written to be useful to the defenders on the other side of it. https://pxlsec.com/blog/feed.xml 2026-10-07T00:00:00Z PXLSechttps://pxlsec.com © 2026 PXLSecurity LTD. https://pxlsec.com/blog/what-an-ai-penetration-test-covers 2026-10-07T00:00:00Z

Scope an AI security assessment across administration, data retrieval, agent actions and prompt injection, with clear permissions, evidence and safety limits.

https://pxlsec.com/blog/we-almost-never-need-an-exploit 2026-10-07T00:00:00Z

Across our own engagements the severe findings are configuration, identity and misplaced trust — not memory corruption. What that means for where you spend remediation effort.

https://pxlsec.com/blog/how-to-choose-a-penetration-testing-provider 2026-10-07T00:00:00Z

What actually separates providers, the questions that expose the difference, and what a cheap quote is usually buying. Written to be useful even if you pick someone else.

https://pxlsec.com/blog/does-soc-2-require-a-penetration-test 2026-10-07T00:00:00Z

What SOC 2 says about security testing, how Type 1 and Type 2 evidence differ, and which testing expectations to agree with your service auditor.

https://pxlsec.com/blog/vulnerability-scan-vs-penetration-test 2026-10-06T00:00:00Z

A scan tells you what is probably wrong. A test proves what an attacker could do with it. Where each earns its place, and the mistake buyers keep making.

https://pxlsec.com/blog/ai-admin-plane-first-risk 2026-10-05T00:00:00Z

AI administration, credentials and artefact access deserve explicit testing alongside prompt injection. How to separate confirmed access from potential downstream impact.

https://pxlsec.com/blog/penetration-test-vs-red-team 2026-10-05T00:00:00Z

One maps your weaknesses, the other measures whether anyone notices an intruder. Choosing the wrong one is an expensive way to learn the difference.

https://pxlsec.com/blog/what-drives-the-cost-of-a-penetration-test 2026-10-04T00:00:00Z

Why two honest quotes for the same words can differ enormously, what actually determines effort, and the questions that make proposals comparable.

https://pxlsec.com/blog/how-long-does-a-penetration-test-take 2026-10-04T00:00:00Z

The testing is rarely the long part. What actually drives the calendar, what you control, and why leaving the retest out of the plan is the usual mistake.

https://pxlsec.com/blog/your-tenant-boundary-is-an-http-header 2026-10-03T00:00:00Z

A confirmed cross-tenant read, an unconfirmed write attempt, and practical guidance for testing SaaS tenant isolation without overinterpreting HTTP status codes.

https://pxlsec.com/blog/red-team-vs-purple-team 2026-10-02T00:00:00Z

Red teams measure whether you detect an intruder. Purple teams fix the detections while you watch. When each is worth the money.

https://pxlsec.com/blog/controls-that-are-present-and-inert 2026-10-01T00:00:00Z

Why configured security controls may fail in practice, and how to assess browser headers, CORS, CSRF and login binding without overclaiming impact.

https://pxlsec.com/blog/ptaas-vs-manual-penetration-testing 2026-09-30T00:00:00Z

PTaaS is a delivery model; manual testing is a method. Compare human effort, coverage, evidence and retest terms without confusing the two.

https://pxlsec.com/blog/pci-dss-segmentation-testing-explained 2026-09-30T00:00:00Z

Segmentation testing isn't a pentest of the cardholder data environment — it's proof that the controls keeping systems out of scope actually work. What that takes.

https://pxlsec.com/blog/remediation-decay 2026-09-29T00:00:00Z

We re-ran every finding from a client's previous report. About half were still live. Why remediation decays, and what 'fixed' has to mean to be worth anything.

https://pxlsec.com/blog/internal-vs-external-penetration-testing 2026-09-28T00:00:00Z

Testing the perimeter answers a different question from testing what happens after someone is already inside. Why assumed breach became the default.

https://pxlsec.com/blog/questions-to-ask-before-signing-a-pentest-sow 2026-09-27T00:00:00Z

Scope, rules of engagement, stop conditions, retest terms and data handling — what must be written down before anyone starts testing.

https://pxlsec.com/blog/dora-tlpt-vs-penetration-test 2026-09-26T00:00:00Z

Most financial entities need a testing programme. Comparatively few are designated for threat-led testing. How the two obligations differ, and how to prepare for the one you actually face.

https://pxlsec.com/blog/red-flags-in-a-penetration-test-proposal 2026-09-24T00:00:00Z

A quote with no scoping conversation, day counts that cannot cover the scope, and other tells — with the question that exposes each one.

https://pxlsec.com/blog/disproving-the-cve 2026-09-23T00:00:00Z

How to investigate version-based CVE candidates, distinguish verified prerequisites from negative probes, and document the limits of a conclusion.

https://pxlsec.com/blog/penetration-testing-buyers-checklist 2026-09-22T00:00:00Z

What to decide before you approach anyone, what to ask providers, how to compare proposals fairly, and what to prepare so the engagement is not wasted.

https://pxlsec.com/blog/how-to-read-a-penetration-test-report 2026-09-19T00:00:00Z

What each section is for, what severity ratings really mean, how to spot a scanner echo, and how to turn a report into a remediation plan.

https://pxlsec.com/blog/idor-the-bug-that-still-owns-apis 2026-08-25T00:00:00Z

Insecure direct object references are the least glamorous bug in the book — and still one of the most common serious findings we report. Why they persist, and how to design them out.

https://pxlsec.com/blog/what-we-actually-find 2026-03-10T00:00:00Z

Across web, mobile, cloud, internal and red-team work, the same handful of root causes show up again and again. Here are the patterns we see most — and what they say about where to spend your security budget.

https://pxlsec.com/blog/business-logic-flaws 2025-09-30T00:00:00Z

No injection, no misconfiguration — just an application doing exactly what it was told, in an order it shouldn't allow. Business-logic flaws are where manual testing earns its keep.

https://pxlsec.com/blog/graphql-introspection-not-hidden 2025-03-18T00:00:00Z

Disabling introspection feels like locking the door. It isn't. Here's how GraphQL schemas leak anyway, how APIs get exhausted, and what actually hardens them.

https://pxlsec.com/blog/purple-teaming-detections 2024-08-07T00:00:00Z

A red team tells you an attacker got in undetected. Purple teaming turns that uncomfortable finding into concrete, tested detection improvements — fast.

https://pxlsec.com/blog/dora-nis2-what-to-test 2024-02-19T00:00:00Z

Two EU regimes raised the bar on security testing for a huge range of organisations. A plain-language guide to what they expect — and how to prepare.

https://pxlsec.com/blog/ntlm-relay-modern-ad 2023-10-24T00:00:00Z

Understand NTLM relay prerequisites, cross-protocol limits, authentication coercion and the protections needed for SMB, LDAP and AD CS.

https://pxlsec.com/blog/threat-modelling-that-works 2023-05-11T00:00:00Z

Threat modelling engineers will actually use: a short, repeatable conversation that catches expensive design bugs before anyone writes the code.

https://pxlsec.com/blog/ssrf-cloud-metadata 2022-11-09T00:00:00Z

How SSRF can reach cloud metadata, what IMDSv2 and its response hop limit protect, and what blind callbacks do and do not prove.

https://pxlsec.com/blog/secrets-in-source-code 2022-03-15T00:00:00Z

How to detect exposed secrets, revoke their authority and decide on repository cleanup, with practical limits for entropy rules and short-lived credentials.

https://pxlsec.com/blog/owasp-api-top-10-in-practice 2021-09-28T00:00:00Z

APIs break differently from web apps. The OWASP API Top 10 names the risks — here's which ones we actually find most, and what to do about them.

https://pxlsec.com/blog/bloodhound-to-domain-admin 2021-07-13T00:00:00Z

A full walkthrough of how we use BloodHound on engagements to turn a single low-privileged foothold into Domain Admin — and, for every step, how blue teams detect and close the path.

https://pxlsec.com/blog/kerberoasting-explained 2021-04-20T00:00:00Z

How Kerberoasting uses service tickets for offline password guessing, which activity can be audited, and how managed service accounts reduce risk.

https://pxlsec.com/blog/reproducible-pentest-reports 2020-10-06T00:00:00Z

A penetration test report is only as good as an engineer's ability to reproduce every finding. Here's what reproducible reporting looks like, and why it's the real test of a testing firm.

https://pxlsec.com/blog/password-spraying-still-works 2020-05-14T00:00:00Z

How password spraying can evade some per-account thresholds, how to detect it without logging passwords, and how to protect user and workload identities.

https://pxlsec.com/blog/database-superuser-is-your-blast-radius 2019-03-26T00:00:00Z

How application credentials expand a compromise, and what least privilege, tenant isolation and KMS encryption can and cannot contain.

https://pxlsec.com/blog/your-mobile-app-is-a-credential-vault 2018-01-30T00:00:00Z

Hardcoded credentials, local encryption and runtime controls: what a mobile assessment can verify, and the different roles of Keychain, Secure Enclave and Keystore.

https://pxlsec.com/blog/scanner-is-not-a-pentest 2016-03-08T00:00:00Z

Scanners are useful — but buying a scan branded as a penetration test leaves real risk on the table. Here's the difference, and how to tell which one you're actually getting.