Blog and Knowledge
Insights from ethical hackers on the front lines of cybersecurity. Practical guidance, threat intelligence, and lessons learned from real security engagements.
Breached through your supplier: what to ask, what NIS2 requires and what to test
Three breaches this year ran through a supplier of the victim. What to ask your suppliers, what NIS2 requires and which part you have tested yourself.
Cloud security assessment checklist: 12 checks for Microsoft 365, Entra ID, Azure and AWS
Twelve checks you can run yourself in Microsoft 365, Entra ID, Azure and AWS with a reader role, what to fix first, and when an external assessment or a cloud pentest is the next step.
From prototype to production: a go-live security check for AI-built apps
AI coding tools build a working app in days, but they rarely decide who may see which data. Seven checks to run before launch, which ones you can do yourself, and when a go-live pentest is worth it.
NIS2 and security awareness: what the law requires and how you prove it
NIS2 asks for regular security awareness training, management included, and leaves the format open. What Articles 20 and 21 say, which five records an auditor wants to see and how to build them in four quarters.
Critical PHP flaws: what to check now and what to have tested
Two critical PHP flaws let an attacker run code without logging in, and the patch only works once every worker restarts. Here is what to check yourself, and what to have tested from the outside.
OWASP Top 10 for agentic applications: what to test per risk
The OWASP Top 10 for agentic applications works better as a test plan than as a checklist. This post turns three of its risks into concrete tests: what a pentest checks, how we try to break it and which measure closes the gap.
Measuring security awareness beyond click rates
A low click rate after a phishing test feels like good news, but on its own it says little about behavior. These are the measures that do show whether people act differently: reporting rate, time to report, repeat mistakes and what they do under pressure.
External or internal pentest: which one first?
An external pentest shows what an attacker reaches from the internet, an internal one shows how far they get after a first foothold. A short decision guide for which test to run first, and why auditors often want both.
Hosted AI Agents: Five Settings to Test Before They Go Live
Hosted agent platforms handle the agent loop, sandboxing and session storage for you. The security decisions do not disappear. They move into five settings you need to test.
CRA for software and digital products: what should you have tested?
Since 11 September 2026, manufacturers must report exploited vulnerabilities in products with digital elements. What the Cyber Resilience Act requires now, what follows in December 2027, and what a pentest can and cannot do.
Stolen Credentials: Why Infostealers Are the Easiest Way Into Your Network
Infostealers turn one infected laptop into working logins for your network. What they take, why MFA alone is not enough, and what to check first.
ASCII smuggling: invisible characters in phishing and AI prompts
Invisible Unicode characters make a phishing email look normal to you while your email filter reads a different word. Microsoft saw the technique used at scale in early 2026, and it comes straight out of prompt injection research.
The service desk as front door: will your helpdesk refuse a reset?
Attackers do not crack your password, they call the service desk and ask for a reset. This post explains which checks hold up on the phone and what a social engineering test shows about your verification process.
Agentjacking: how one fake error report hijacks your coding agent
An attacker submits a fake error report through a public Sentry DSN and your coding agent runs the command inside it. Read this before you let an agent near your logs: what it reads, what it runs without confirmation and what sits on that machine.
Pentesting on Demand with RedSOC: How It Works and When to Use It
RedSOC is on-demand pentesting by ethical hackers: you request a test when you need it. How a request runs, what you can ask for and when it fits.
Gamified Phishing Simulations: Why a Swipe Game Beats a Slide Deck
Annual e-learning asks people to watch. A gamified phishing simulation asks them to decide, and corrects them on the spot. Here is why the format works, and where it sits next to a classic phishing test.
Black box, grey box or white box pentest: which one fits?
Black box, grey box or white box is a question about what the tester knows before the test starts. This guide explains what each form tests, what it asks from your team and which one answers the question you have.
Can One Web Page Hijack an AI Browsing Agent?
An AI browsing agent treats every page it opens as input, and sometimes as an instruction. These are the four questions a pentest asks first, before you let such an agent near your mailbox and your local machine.
How to Read a Pentest Report: What to Fix First and What to Push Back On
Counting red rows is the least useful way to read a pentest report. How to follow the attack paths, check the evidence behind each finding and decide what to fix first.
AI Pentest or Human Pentest? What Each One Is Good For
AI pentesting tools cover breadth and speed. A human-led pentest adds depth, context and a report someone stands behind. When to use which, and how to combine them.
Agentic AI Supply Chain Security: When Your Agent's Skills Become the Attack Path
Agent skills, plugins and MCP servers are executable code, not passive configuration. CVE-2026-25253 was the first CVE ever assigned to an agentic AI system. Here is how to test and harden the supply chain behind your agents.
Your AI Agent Can Reach Your Production Database. Have You Tested That?
Coding agents and MCP servers hold real access to your code, CRM, and production. A prompt is not a permission layer. Here is what to test and why it matters.
Is Your Vibe-Coded App Leaking Data? Why AI-Built Dashboards Need a Pentest
Anyone can now build a working app from a text prompt with tools like Lovable or Bolt, and those apps reach production with broken authorisation and exposed data. Scanners miss it. Here is what a pentest on a vibe-coded app finds, and why the platform's own checks will not save you.
Cloud IAM Pentesting: The Identity Misconfigurations Attackers Actually Exploit
A cloud IAM pentest and configuration audit reveal whether role assignments, PIM gaps, conditional access scope, and service principal sprawl in Entra ID, AWS, and GCP can actually be exploited.
Deepfake Vishing: When Employees Can No Longer Trust a Familiar Voice
AI voice cloning can now convincingly impersonate an executive or IT support call. We look at how deepfake vishing works and what actually stops it.
How to Discover Shadow AI in Your Organisation
Shadow AI hides across identity, SaaS, endpoints, code and cloud, and no single tool sees all of it. Here is how to discover unapproved AI tools with the logs you already have, and where a one-time audit stops and human validation begins.
From a Misconfigured Grafana to 507 Private Meta Repos: A Bug Worth $157K
A routine recon flag on a public Meta IP running an open Grafana grew into a five-hop chain that ended at 507 private Meta repositories. We proved impact without cloning a single file. Meta awarded $157K.
Retest included in every pentest
A pentest without a retest is only half the job. Here is what a retest is, why verifying your fixes matters, and why Sectricity always includes the retest and report in the price.
What is CEO Fraud? Executive Impersonation Attacks Explained for Finance Teams
CEO fraud is a targeted form of Business Email Compromise where criminals impersonate senior executives to trick finance or HR staff into making urgent payments or sharing sensitive data. This guide explains how the attacks work, why they succeed, and which concrete procedures reliably stop them in 2026.
Am I Hacked? 10 Warning Signs and What to Do Next
Think you might be hacked? Learn the 10 most reliable warning signs of compromise, the first 5 actions to take in order, and when to call professional incident response support.
What is a Vulnerability Assessment?
A vulnerability assessment scans for known weaknesses, but scanning alone never tells the whole story. Here is what it covers, where it stops, and why human validation turns a raw list into real risk.
What is Swishing?
Most phishing training is forgotten within weeks. Swishing turns phishing awareness into a game, so people practise catching attacks in realistic scenarios and actually keep what they learn.
What is Smishing?
Smishing is phishing via SMS or WhatsApp. This article explains what smishing is, why it works so well, typical attack scenarios, and how companies protect their employees with simulations, processes and awareness training.
What is Social Engineering?
Social engineering is the most effective attack technique in modern cybercrime because it targets people instead of systems. This article explains what social engineering is, the main variants, why it works so well, and what companies can concretely do to make their people resilient.
What is Phishing?
Phishing does not succeed because of technology, but because of timing, context and human reflex. This article explains what phishing is, which types exist and how companies reduce successful attacks.
Red Teaming: When Your Organisation Needs More Than a Pentest
A penetration test tells you where vulnerabilities exist. A red team exercise tells you whether your organisation can detect, contain, and respond to a real attack. This guide explains what red teaming is, when you need it, and how it differs from a standard pentest.
Prompt Injection Explained: How Attackers Manipulate Your AI Systems
Prompt injection is the most common attack against AI systems in production. This guide explains how it works, why standard security controls miss it, and what you can do to reduce the risk before the EU AI Act deadline hits.
Social Engineering Assessment: What We Test and Why It Matters
Phishing filters and endpoint protection stop most automated attacks. Social engineering targets the one thing no filter can block: your people. This guide explains what a social engineering assessment tests, how each technique works, and what your organisation learns from it.
How to Solve Phishing Structurally: Identity, Telecom and Payments
Phishing keeps working because the underlying systems still allow impersonation. This article looks at identity, telecom and payment-side controls in the EU and shows which interventions actually reduce damage structurally.
Security Awareness Training: Why It Matters and How to Build a Programme That Works
Most breaches start with human error. Security awareness training reduces that risk, but only if it goes beyond annual e-learning. This guide covers what works, what does not, and how to build a programme your staff will actually remember.
AI, NIS2, and the EU AI Act: What Security and Compliance Teams Need to Do After the May 2026 Digital Omnibus Agreement
NIS2, the EU AI Act, and DORA now converge on organisations deploying AI. After the May 2026 Digital Omnibus agreement, deadlines shifted to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). This guide maps where the three frameworks overlap and how a single integrated assessment satisfies all three.
EU AI Act: What Does It Mean for Your Security and Compliance after the Digital Omnibus Agreement (May 2026)?
The May 2026 Digital Omnibus agreement moved EU AI Act high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). What does that mean for your AI security, compliance, and governance?
Incident Response Plan: What to Do in the First 72 Hours After a Cyberattack
NIS2 and DORA require you to report significant incidents within 24 hours. Most organisations have no plan for the first 72 hours. This guide covers what an incident response plan must contain, who does what, and how to meet your regulatory reporting obligations under pressure.
Penetration Testing in the EU: What You Need to Know in 2026
NIS2, DORA, the EU AI Act, and ISO 27001 all require security testing. This guide explains what each regulation demands, where they overlap, and how to build one testing programme that satisfies all four.
NIS2 Penetration Testing Checklist: What your auditor really wants to see in 2026
Discover which penetration testing and security testing auditors really expect for NIS2 compliance across Belgium, the Netherlands and the EU. Includes a practical checklist, audit pitfalls and concrete steps to become provably compliant and audit-ready.
Pentest Subsidies in Belgium: How the kmo-portefeuille and VLAIO Cut Your Security Costs
Flanders now reserves its SME advisory subsidy exclusively for cybersecurity. What that means in practice: 45% off a pentest for small companies, and up to 50% for larger improvement tracks.
AI Systems Penetration Testing: How to Test the Security of an AI System
AI systems introduce attack surfaces that standard penetration testing does not cover. This guide explains how to test the security of an AI system, what the EU AI Act requires, and how AI pentesting differs from conventional application security testing.
Cyber Insurance in 2026: What Insurers Require and How a Pentest Helps
Cyber insurers are tightening requirements. Organisations without documented security testing, MFA, and incident response plans are facing higher premiums or outright exclusions. This guide explains what insurers actually assess and how a penetration test strengthens your position.
MCP Security: the new attack chain targeting AI Tools
The Model Context Protocol (MCP) creates a new attack surface for AI agents and internal tools. Discover how attackers exploit MCP and how to protect your organization with AI security testing.
How much does a Pentest cost? Realistic Security Costs in Belgium, the Netherlands and the EU
Discover what a pentest really costs in 2026. See realistic EU price ranges, key cost drivers, and how pentesting supports compliance with NIS2, DORA and other.
Pentest Checklist: what should you include in a Pentest engagement?
Complete pentest checklist for companies. Learn what to include in a pentest engagement to test real risks and avoid critical blind spots.
What does a Hacker really do? From OSINT to Pentesting
Hackers work deliberately, starting with public information and human behavior. This article shows how OSINT and realistic pentesting safely reveal how attackers would approach a company.
What do we mean by effective Security Awareness?
Effective security awareness goes beyond knowing what phishing is. It is about how employees in companies respond under pressure, dare to report mistakes, and make the right decisions in realistic situations.
How to prevent Business Email Compromise (BEC): a Practical Guide
Business Email Compromise (BEC) is a targeted scam where attackers impersonate executives or suppliers. Learn practical steps like MFA, verification procedures, and phishing testing to reduce risk.
Phishing Awareness: Practical Risk Reduction for Your Team
Phishing awareness is a key part of cybersecurity awareness training. Phishing attacks exploit human behaviour through social engineering techniques such as appeals to urgency, authority, and trust.
What is a full-scope Pentest?
A full-scope pentest by ethical hackers demonstrates how a company can be truly attacked. Far more than automated scans alone: abuse scenarios, business logic flaws, attack chains, and clear, actionable reporting.
What is Red Teaming?
Red teaming has moved from niche cybersecurity practice into the regulatory mainstream. This article explains what red teaming actually is, the six techniques red teamers use, how engagements unfold, three concrete examples, and which sectors should treat red teaming as essential rather than optional.
API Security Testing: Why Your APIs Are Your Weakest Link
APIs are the fastest-growing attack surface in modern applications. Most organisations test their web interfaces but leave their APIs inadequately assessed. This guide explains what API security testing covers, why APIs are disproportionately vulnerable, and what findings to expect.
Web Application Penetration Testing: What Gets Tested and What It Reveals
A web application penetration test goes beyond automated scanning. Human testers chain vulnerabilities, test business logic, and find what scanners miss. This guide explains what a web application pentest covers, how it differs from a vulnerability scan, and what findings to expect.
The Rise of AI-Powered Attacks: What Ethical Hackers Are Seeing
Attackers are leveraging AI to craft more convincing phishing emails and automate reconnaissance. Here's what organisations should watch for.
Annual Pentest or PTaaS? A Realistic Cost Comparison
Should you choose an annual pentest or PTaaS with continuous security validation? This article compares costs, ROI and practical differences, helping companies make a realistic, risk-based decision.
Physical Penetration Testing: What Testers Actually Find Inside Your Building
Physical penetration testing tests whether the physical controls protecting your systems, data, and people actually work. Locked doors and access card systems fail more often than organisations expect. This guide explains what physical penetration testing covers and what assessors consistently find.
Why Ethical Hacking makes companies stronger: 5 concrete benefits
Ethical hacking gives companies insight into real attack paths, helps set the right priorities, and reduces incident risk. Discover 5 concrete benefits and how an ethical hacker strengthens your security.
Penetration Testing vs. Vulnerability Scanning: Know the Difference
Many organisations confuse automated scanning with real penetration testing. We explain the differences and when you need each approach.
Cloud Security Assessment: What Gets Reviewed and What Assessors Consistently Find
Cloud misconfigurations are among the most common causes of data breaches. Most organisations have a well-tested on-premises environment and an undertested cloud environment. This guide explains what a cloud security assessment covers and what assessors consistently find.
Building a Security-Aware Culture: Beyond Annual Training
Compliance checklists alone do not make an organisation secure. Policies, tools, and one-off training sessions help, but they do not change behaviour.
Zero Trust Security: What It Actually Requires and How to Test It
Zero Trust means no user, device, or connection is trusted by default. This guide explains what Zero Trust actually requires in practice, how it maps to NIS2, and how penetration testing reveals whether your controls work as intended.
Social Engineering in the Remote Work Era
Social engineering remains one of the most effective attack methods because it targets human behaviour. The shift to remote work has expanded both the attack surface and the need for stronger employee security awareness.
Security Awareness on Wheels
Our exciting Security Escape Truck brings cybersecurity awareness directly to your doorstep, offering a unique combination of learning and collaboration.
Understanding NIS2: What European Organizations Need to Know
The NIS2 directive expands cybersecurity requirements across the EU. Learn what's changing and how to prepare your organization for compliance.
Stay Informed
Get the latest security insights delivered to your inbox. No spam, just practical guidance from ethical hackers.
Subscribe to UpdatesNeed Security Expertise?
Our ethical hackers are ready to help secure your organisation.