Should I Whitelist A Penetration Tester’s IP?

Should I Whitelist A Penetration Tester’s IP?

While working out the details with a client for an upcoming security assessment, whitelisting the penetration testers IP addresses always generates additional conversation. It may seem odd because you wouldn’t whitelist your adversaries to bypass a security control,...
Is “After-Hours” Testing Worth It?

Is “After-Hours” Testing Worth It?

A concern we often hear while scoping security assessments is around impacting the current operating rhythm of an organization. This is a valid concern as the last thing an IT leader wants is to negatively impact the business when it could have been avoided. The first...
So You Want to Be a Hacker: 2021 Edition

So You Want to Be a Hacker: 2021 Edition

Video Version: https://www.youtube.com/watch?v=mdsChhW056A Introduction Recently, I posted a 36-part Twitter thread (https://twitter.com/thecybermentor/status/1343471814132031488) on how to become an ethical hacker in 2021. Given that it was well received, I thought...
Pentest Tales #001: You Spent How Much on Security?

Pentest Tales #001: You Spent How Much on Security?

Welcome to the first edition of Pentest Tales, a blog series that walks through real-world pentests we’ve performed in the past. The purpose of this blog is not just to share the “owning” of a domain, but to provide education as to why a domain was...