Detective control testing during penetration tests Scott Sutherland Guest Blogs for Secure360

A pentest is a time-boxed, authorized attack where ethical hackers chain flaws to prove exploitable risk, not just run scans. It outlines deliverables, audit drivers, and when to test.

Semperis contrasts Microsoft's Zero Trust Assessment with its Entra ID Security Assessment: maturity scoring measures framework alignment, while exposure assessments find exploitable attack paths.

Part 3 of the red teaming series: joint red/blue debriefs, blameless post-mortems, and shared processes turn exercise findings into lasting security improvements.

Based on dozens of mainframe assessments, NetSPI's 2025 State of the Platform report covers MFA adoption, DES-to-AES cryptographic modernization, and persistent security gaps in enterprise mainframes.

External penetration testing examines internet-facing services, while internal testing simulates insider threats or post-breach attackers. This article compares the two approaches and their use cases.

A curated list of 17 resources for aspiring defensive AppSec engineers, spanning security fundamentals, web application basics, hands-on practice, continuing education, and professional organizations.