Method3 min read
What a $700 black box pentest actually buys you
The honest version: what fits inside a small external scope, what does not, and when the cheap test is the right one.
Read the post
[ Writing ]
Notes from the people doing the testing.
No vendor thought-leadership and no breach commentary. The bug classes we report most often, how an engagement actually runs, and the questions buyers ask us before they sign.
- Posts
- 6
- Written by
- Certified testers
- Cadence
- Monthly
Everything else
5 posts
- Method7 min read
What the 2025 OWASP Top 10 ranking actually measures
Two new categories, SSRF folded into access control, and supply chain straight in at number three. What the data actually says, and what it changes about testing.
Vaptiq Testing Team
- Findings3 min read
Tenant isolation: the bug class SaaS teams keep shipping
One account reaching another account's data is the finding we report most often, and it almost always arrives through the same three doors.
Vaptiq Testing Team
- AI security4 min read
Prompt injection is an access-control problem
Treating it as a content-filtering problem is why the mitigations keep failing. What we test when an LLM can call your tools.
Vaptiq Red Team
- Compliance3 min read
The pentest report your auditor actually wants
Three documents do different jobs, and sending the wrong one to a customer is how a security review stalls for a month.
Vaptiq Testing Team
- Findings3 min read
How we guess your password reset tokens
Predictable reset tokens are account takeover waiting to happen. The entropy failures we find, and the four-line fix.
Vaptiq Testing Team
Reading about it is cheaper than finding out the hard way.
If one of these describes a system you own, tell us which one. We will tell you what a test would cover and what it would cost, in writing.