Field notes on offensive security

How AI is changing penetration testing, what auditors actually want, and how to ship secure fast.

Guide·June 30, 2026·9 min

How much access should you give a pentester?

The instinct is to lock every door before the test. That instinct gives you a worse test. A field guide to black box, gray box, white box, and the access that actually finds what an attacker could.

Compliance·June 26, 2026·8 min

Does SOC 2 require a penetration test?

The honest answer: no, not in the literal text, and yes, in every way that matters. What the Trust Services Criteria actually say, and why skipping the pentest is the harder path.

Buying·June 23, 2026·7 min

How much does a penetration test cost in 2026?

Real ranges, not a sales call. A typical web-app engagement runs $10,000 to $30,000, but the number you pay is set almost entirely by a few decisions you control. Here is what actually drives the bill.

Fundamentals·June 19, 2026·6 min

Penetration testing vs vulnerability scanning: the difference that matters

They get used interchangeably, sold interchangeably, and they are not the same thing. One finds patterns that look wrong. The other proves what an attacker could actually do. Confusing them is expensive.

AI security·June 16, 2026·6 min

Is AI-generated code secure? What the data says

It compiles, it passes tests, it ships. It is also insecure a startling share of the time, and the people writing it feel more confident, not less. The evidence, and what to do about it.

Buying·June 12, 2026·7 min

How to scope a penetration test (without overpaying or under-testing)

Scoping is the most important step in a pentest and the most overlooked. Get it wrong and you either burn budget testing the wrong things or get a clean report that proves nothing. Here is how to get it right.

Fundamentals·June 9, 2026·6 min

What is penetration testing, really?

Past the jargon, a penetration test is one thing: an authorized attack that proves what a real adversary could do to you. A plain-English guide to what it is, how it works, and why it is not a scan.

Fundamentals·June 5, 2026·7 min

The phases of a penetration test, start to finish

A real pentest is not one act, it is a sequence: scope, recon, map, exploit, chain, verify, report. Knowing the arc tells you where the value is and where corners get cut.

Fundamentals·June 2, 2026·6 min

Red team vs penetration test vs vulnerability assessment

Three terms, used interchangeably, that mean three different engagements with three different goals. Buying the wrong one is how you overpay for the test you did not need.

Fundamentals·May 29, 2026·5 min

What is a proof-of-concept exploit, and why your report needs one

It is the single thing that separates a real finding from a guess: a working demonstration that a weakness is actually exploitable. If your report does not have them, you did not get a pentest.

Compliance·May 26, 2026·7 min

PCI DSS penetration testing requirements, decoded

PCI DSS is the rare framework that names penetration testing as a hard requirement, with specific frequencies, scope, and a methodology mandate. Here is what Requirement 11.4 actually asks for.

Compliance·May 22, 2026·6 min

HIPAA and penetration testing: required, recommended, or neither?

HIPAA never says the words penetration test. It does require you to evaluate whether your safeguards actually protect patient data, and that is a bar a pentest is uniquely suited to clear.

Compliance·May 19, 2026·6 min

What auditors actually want from a pentest report

A pentest report that satisfies your engineers can still fail your audit. Auditors read for a specific set of things, and most of them are about scope, evidence, and proof you closed the gaps.

AI security·May 15, 2026·6 min

What is IDOR? The bug AI loves to write

Insecure direct object reference is one of the simplest, most common, and most damaging web vulnerabilities, and AI coding assistants reproduce it at scale. Here is how it works and how it is found.

AI security·May 12, 2026·6 min

Broken access control: still the number one web vulnerability

It tops the OWASP Top 10 for a reason. Access control is logic a tool cannot infer and a model rarely writes correctly, which is why it is both the most common serious flaw and the hardest to scan for.

AI security·May 8, 2026·6 min

Prompt injection is the new injection

If you shipped an AI feature, you shipped a new attack surface. Prompt injection tops the OWASP list of LLM risks because the model cannot reliably tell your instructions from an attacker's.

Buying·May 5, 2026·6 min

How to choose a penetration testing vendor: the questions that matter

Most pentest vendors look identical on a website. The difference shows up in the answers to a handful of pointed questions about proof, scope, methodology, and what happens after the report.

Buying·May 1, 2026·5 min

How long does a penetration test take?

Active testing is usually days, but the calendar from kickoff to final report is usually weeks. Here is where the time actually goes, and which parts you can compress.

Buying·April 28, 2026·6 min

What to do after a pentest: the remediation and retest loop

The report is the start of the work, not the end. How you triage, fix, and verify findings decides whether the test made you safer or just gave you a PDF.

Fundamentals·June 4, 2026·6 min

CVSS, CWE, and CVE, explained without the jargon

Three acronyms that show up in every security report and get confused constantly. One scores severity, one names the type of flaw, one names a specific known bug. Here is the difference, plainly.

Fundamentals·May 31, 2026·5 min

What is OWASP, and why every pentest report mentions it

OWASP shows up in every security conversation and every methodology. Here is what it actually is, why the Top 10 became the industry's shared language, and what it means when a report cites it.

Compliance·May 28, 2026·6 min

SOC 2 Type I vs Type II, and where the pentest fits

Type I checks that your controls are designed right; Type II checks they actually worked over time. The difference changes when your pentest needs to happen and what evidence it has to show.

Compliance·May 24, 2026·6 min

How often should you run a penetration test?

Once a year is the floor most frameworks set, and the floor is no longer enough. What compliance requires, what significant change means, and why the honest answer is tied to how often you ship.

AI security·May 20, 2026·5 min

Secrets in the client bundle: how API keys leak from frontends

If a secret reaches the browser, it is not a secret. It is one of the most common and most preventable ways credentials leak, and AI-assisted development makes it easier to do by accident.

AI security·May 17, 2026·6 min

Continuous penetration testing: what it is and when it beats annual

Not a scanner running nightly, and not an annual test scheduled more often. Continuous pentesting is real, proof-backed testing that runs at the pace you ship, and here is when it actually matters.

Buying·May 13, 2026·6 min

PTaaS (pentest as a service), explained

Pentest as a service put pentesting on a platform with a dashboard and a subscription. It fixed the worst parts of the consulting model and kept one big one. Here is what it is and where it falls short.

Buying·May 10, 2026·6 min

What goes in a rules-of-engagement document

The rules of engagement are the contract that keeps an authorized test from becoming an incident, or a lawsuit. Here is what belongs in one and why each part is there.

Buying·May 6, 2026·5 min

Black box vs gray box: why access changes the bill

The same application can cost noticeably more to test black box than gray box, and produce fewer findings for the money. The mechanics of why access moves the price are worth understanding.

Buying·May 3, 2026·6 min

How to prepare for your first penetration test: a checklist

A little preparation turns a stressful, slow engagement into a fast, deep one. Here is what to have ready before kickoff so the test spends its days testing, not waiting on you.

Company·April 24, 2026·5 min

Why we built Uvy

Software ships every day. Penetration tests happen once a year. We built Uvy to close that gap, a pentest that runs as often as you deploy.

Industry·April 21, 2026·6 min

AI just changed the economics of penetration testing

For thirty years the price of a pentest was the price of a person's time. That assumption just broke, and it changes what security teams can demand.

Guide·April 16, 2026·8 min

The vibe-coder's guide to your first SOC 2 pentest

You shipped fast, a customer is asking for SOC 2, and now you need a pentest you didn't plan for. Here's what auditors actually want, minus the jargon.

Engineering·April 13, 2026·8 min

What AI-generated code gets wrong about security

AI writes code that compiles, passes tests, and ships. It also reproduces a predictable set of security mistakes, at scale. Here's the pattern.

Industry·April 9, 2026·6 min

Your annual pentest is already out of date

The report is dated the day it's delivered. Everything you shipped since is untested. Why point-in-time testing stopped matching how software is built.

Guide·April 6, 2026·8 min

How to read a penetration test report

Severity, CVSS, proof-of-exploit, remediation: a plain-English guide to what's in a pentest report and what actually deserves your attention first.

Find every way in, before an attacker does

Uvy runs continuous offense and defense across your applications at machine speed, and hands your team proof and the exact fix. Start a pentest yourself, or talk to us about scope.

Get startedTalk to sales

Free to test. No card to start.

Or write to [email protected]