Cyber security field guides
Cyber security resources for penetration testing.
Practical resources for teams choosing a penetration test, preparing for SOC 2, or fixing a real finding. Each guide separates standards from judgment and shows what useful evidence looks like.
Reviewed October 4, 2026
Start with your question
An auditor or customer asked for a pentest
Work out whether the request applies to SOC 2, what evidence is useful, and which systems belong in scope.
Review SOC 2 requirementsYou need to choose black, gray, or white box
Compare access levels, coverage, realism, and effort before you write the rules of engagement.
Compare testing methodsYou need examples of reportable findings
See safe proof-of-concept examples, realistic severity ranges, evidence, fixes, and retest criteria.
Open the vulnerability guideQuick reference
CVSS severity is a starting point, not the decision.
CVSS v4.0 maps technical scores to five ratings. Prioritization should also account for the exposed asset, data sensitivity, reachable users, exploit prerequisites, and controls already in place.
Learn how to rate a findingThe labels and score bands follow the FIRST CVSS v4.0 qualitative rating scale. A score does not replace environment-specific risk analysis.
The library
One search intent per guide.
Use the SOC 2 page for audit planning, the method comparison for scope design, and the vulnerability guide when triaging findings with engineering.
What Is Penetration Testing as a Service (PTaaS)?
How PTaaS differs from a consultancy pentest, a scanner and bug bounty, the four pricing models with published prices, and ten questions for a provider.
Penetration Testing Companies: 17 Providers Compared
Consultancies, PTaaS platforms, AI-led testers and tools you run, with published prices, retest terms and who each suits.
AI Penetration Testing: What Changes and What Stays Human
AI as the tester and AI as the target, what the measurements support, and the questions that separate a provider from a relabelled scanner.
LLM Red Teaming: A Field Guide
Attacking your own LLM application on purpose: findings taxonomy, how an engagement runs, the open-source tool baseline, and standards.
OWASP Top 10 for LLM Applications (2026)
Each of the ten 2026 risks with a documented attack, how to test for it and what to fix, plus where every 2025 entry moved.
SOC 2 Penetration Testing Requirements
When a pentest supports SOC 2, how Type I and Type II evidence differs, and what to put in scope.
PCI DSS Penetration Testing Requirements
Requirement 11.4 in plain terms: internal and external cadence, segmentation testing, which SAQs include it, and what your assessor checks.
ISO 27001 Penetration Testing Requirements
No pentest mandate, but the Annex A controls it supports, where it fits in the audit cycle, and the evidence to keep.
Black Box vs Gray Box vs White Box Penetration Testing
Compare access, realism, depth, cost, and the situations where each penetration testing method fits.
Common Web Application Vulnerabilities
Safe exploit examples, likely impact, severity ranges, evidence to capture, and practical fixes.
From research to scope
Get your penetration test report in 24 hours.
Share the audit driver, attack surface, and access model. We confirm the scope, authorization, access, and delivery window before testing begins.