This one is a little personal for me. Back in late 2012, I founded the PCI Security Standards Council Third Party Security Assurance Special Interest Group (SIG), and led that work through 2013 and into 2014. The problem we were trying to address was already becoming one of the most difficult areas of PCI DSS:
PCI SSC’s New TPSP Guidance: Twelve Years Later, Are We Still Missing the Point? Read More »
Why does a localised software failure make international breaking news, while a structural supply chain collapse, costing 100x more, fades into a “quirky” memory? The contrast between the 2018 UK Carbon Dioxide Shortage and recent refrigeration cyberattacks reveals a fascinating flaw in how we perceive operational risk. When hackers forced networks of European supermarket freezers
The Beer and Crumpet Crisis Read More »
Binance has reported a $6.3 billion cryptocurrency security breach, potentially the largest crypto theft in history. Initial findings point to compromised internal systems, raising critical questions about privileged access, transaction authorisation and incident response. Tim Holman examines what happened and the lessons for organisations beyond cryptocurrency.
Copy
Binance Hack: $6.3 Billion Stolen in Record Crypto Heist Read More »
What a good penetration test report should contain, seven tests to judge the one you’ve been given, what each reader needs from it, and what to do once it arrives.
What a Good Penetration Test Report Looks Like and What to Do Next Read More »
Ten terms to check in a penetration testing contract before you sign: authorisation, third-party permission, escalation, data retention, confidentiality, subcontractors, liability, report ownership and complaints.
Penetration Testing Contract Terms to Check Before You Sign Read More »
A penetration test plan is the tester’s working document for your test: the goal, the threat model, the validated targets and the rules of engagement. How it’s built after the scoping call, and five things to check in yours.
How a Penetration Test Plan Is Built, and What to Check in Yours Read More »
The recent ASOS incident has got me thinking about a problem I’ve seen repeatedly over the years in penetration testing and security assurance. We often define “critical” systems based on what customers can see. Payment page? Critical. Login page? Critical. Checkout process? Critical. So that’s what gets tested. The problem is that modern businesses are
Stop Testing What Customers Can See Read More »
A penetration test is priced by the tester-days its scope needs. Why quotes for the same test differ so widely, what drives the days up or down, and how to get quotes you can actually compare.
Penetration Testing Cost in the UK and Why Quotes for the Same Test Differ Read More »
The OWASP Top 10 is the ten most critical web application security risks, currently the 2025 edition. What each one means in plain English, and what to ask for when you buy a web application penetration test.
The OWASP Top 10 Explained for Anyone Buying a Penetration Test Read More »
