The Shieldome Siege Blog
Notes on authorized penetration testing: how scope actually gets enforced, why exploit confirmation should never run itself, and what a defensible audit trail looks like in practice.
Notes on authorized penetration testing: how scope actually gets enforced, why exploit confirmation should never run itself, and what a defensible audit trail looks like in practice.
What a CVSS v3.1 base score actually measures, why it belongs in a report alongside a plain severity label, and how to read one honestly.
SSO is not just convenience. For a tool holding scope documents, exploit approvals, and an audit trail, who has access is itself a security decision.
A pentest report that never leaves the PDF does not fix anything. Why the handoff from finding to ticket to retest is the part that actually matters.
Business logic flaws break an application's intended workflow rather than its code. They are exactly the category automated scanners are least equipped to find.
Bug bounty programs and penetration tests both find vulnerabilities, through very different mechanisms. Here is when each one actually makes sense.
A web application firewall is a mitigation, not a fix. Testing whether it can be bypassed shows how much protection you are actually relying on.
Automated tools have gotten genuinely good at detection. They still cannot replace the specific things a skilled human tester brings to an engagement.
There is no single universal answer, but there are concrete triggers that should prompt a test regardless of when the last one happened.
Startups often need a penetration test before they are ready to run one at enterprise scale. Here is how to approach it on a limited budget.
Internal and external penetration tests answer different questions about your environment. Most mature security programs need both, not one or the other.
The structure of a penetration test report matters as much as the findings inside it. Here is what a genuinely useful template actually includes.
AWS allows customer-initiated penetration testing against most services without prior approval, but the actual rules are more specific than most teams realize.
CSRF tricks a logged-in user's browser into sending a request they never intended to send. Here is how it works and why it still shows up in real applications.
SSRF lets an attacker make a server send requests on their behalf, often reaching internal systems that were never meant to be exposed.
IDOR is one of the simplest vulnerability classes to understand and one of the most common findings in real engagements. Here is why it keeps happening.
XXE abuses a legacy XML parsing feature that most developers never knew existed. Here is what it is and why it still turns up in modern applications.
Not every firm offering penetration testing delivers the same rigor. Questions worth asking before you sign.
Skipping a test does not remove the risk it would have found. It just moves discovery to a worse moment.
A structured methodology separates a professional penetration test from an unstructured attempt to break things, and here is the sequence it follows.
A practical checklist for scoping and running a penetration test, from the Rules of Engagement through final report delivery.
An annual test tells you about one moment in time. Systems change constantly between tests, and that gap is where continuous testing earns its keep.
What Penetration Testing as a Service actually means, how it differs from a traditional annual test, and when the model genuinely pays off.
The three standard penetration testing approaches differ in how much information the tester starts with, which changes what findings you can expect.
These two terms overlap enough in casual use that the real distinction, in objective and in scope, often gets lost. Here is what actually separates them.
Penetration testing pricing varies enormously based on scope, methodology, and depth. Here is what actually drives the number on a proposal.
How to map pentest findings to the compliance framework your business is actually accountable to.
If you resell or build on a pentest platform, the report your client reads should carry your brand, not your vendor's.
The cloud misconfigurations that keep showing up in pentests, from exposed storage to overly broad IAM roles.
Modern apps are built from far more third-party code than first-party code. Every dependency is part of your attack surface.
How to read a pentest report critically: what to check beyond severity, and what a trustworthy one shows.
Closing the email spoofing gap: what each of these three DNS-based controls actually does.
What an nmap scan actually proves, and what it does not, once you move past the list of open ports.
These two terms get used interchangeably constantly. The gap between them is where expectations most often mismatch.
What each OWASP Top 10 category actually means, without assuming you already write code for a living.
APIs fail quietly. Here is what to check for in REST and GraphQL specifically before calling a review complete.
Using Metasploit responsibly in a client engagement means constraining what it is allowed to do, not just what it can do.
Why a hash-chained audit log, not just an activity log, is what a compliance auditor actually wants to see.
How SQL injection gets detected, and why proving it is exploitable is a separate, more careful step.
Automation is a clear win for detection. Confirming or exploiting a finding is where a human approval step earns its cost back.
Scope should be a technical control checked on every action, not just a paragraph agreed to once at kickoff.
Passive reconnaissance and active scanning carry different risk profiles and belong in different parts of an engagement.
A plain-language guide to authorized penetration testing, how it differs from a vulnerability scan, and what has to be in place first.
What belongs in a penetration test's Rules of Engagement, from scope boundaries to the testing window, and why vague ROE creates risk.