Writing
How agentic testing actually works, where it earns its keep, and where a human researcher is still the only thing that will do.
AI as a Force Multiplier: Not a Replacement for Security Teams
The most effective application security programmes combine automated agentic testing with experienced human researchers. Here is why that combination beats either alone - and what it actually looks like in practice.
OWASP Top 10 for LLMs: What It Means for AI-Powered Security Testing
The OWASP Top 10 for Large Language Model Applications catalogues the most critical risks when deploying AI in production. Here is a technical breakdown of each category and how they apply specifically to agentic security systems.
Agentic Web Application Penetration Testing: A Technical Deep Dive
How purpose-built AI agents plan, execute, and chain web application attacks - covering session management, multi-step exploitation, evidence collection, and the architectural decisions that make agentic testing fundamentally different from scanners.
AI Guardrails in Agentic Security Testing: Architecture and Implementation
A system that can exploit vulnerabilities must be prevented from taking destructive actions, exceeding scope, or leaking sensitive data. This post covers the technical architecture of the guardrail layers that make agentic penetration testing safe to deploy against real applications.
How AI Agents Are Changing Penetration Testing
Purpose-built AI agents can now discover, analyse, and chain vulnerabilities the way an experienced tester does - systematically and at scale. Here is what that means for application security.
Why Traditional Penetration Testing Falls Short for Modern Web Apps
Annual pen tests and one-week engagements were designed for a slower era of software. Modern web applications ship daily - and your security testing cadence should keep pace.
OWASP Top 10 2025: What Developers Need to Know
The OWASP Top 10 remains the most referenced framework for web application security risk. Here is a developer-focused breakdown of each category and the testing approaches most likely to surface them.