Penetration Testing: What is it?

NetSPI argues vendors misuse security terminology, defining a true penetration test as enumeration plus manual verification and safe exploitation—not the scan-only services sold under the name.

After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

A pentest is a time-boxed, authorized attack where ethical hackers chain flaws to prove exploitable risk, not just run scans. It outlines deliverables, audit drivers, and when to test.

Guest article by Joseph Thacker: LLMs make end-to-end vulnerability-assessment automation feasible, aiding blue-team triage and large-scale offensive testing, while scanners still trail humans.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.