[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:penetration-testing":3},{"control":4,"products":25,"stories":87,"lessons":131,"related":156,"compare":168},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.","Authorised experts test your systems the way an attacker would, either as scheduled penetration tests or continuously through a bug bounty or vulnerability disclosure programme.","Scanners find known flaws. People find the logic errors and chained weaknesses that attackers exploit. A disclosure programme also gives outside researchers a legal way to report what they find, instead of it surfacing in the news.",[11,12,13,14],"Are testers vetted, and are scope and legal authorisation documented?","Is retesting after fixes included?","For bug bounty: how are researchers vetted and how are payouts handled?","Can the results serve as evidence for regulators, for example for DORA threat-led testing?","Risk: exploitable weaknesses in internet-facing applications stay unknown until attacked. Control: annual penetration tests plus a vulnerability disclosure or bug bounty programme. Owner: application security lead. Measure: critical findings open past their deadline.",[17,18,19,20],"NIS2 Art. 21(2)(f): assessing the effectiveness of measures","DORA Art. 24 to 26: resilience testing and threat-led penetration testing","CIS Control 18: penetration testing","ISO\u002FIEC 27001:2022 A.8.29: security testing",{"name":22,"slug":23},"Vulnerability Management","vulnerability-management","2026-10-16T12:48:08.297065+00:00",[26,34,39,47,55,63,71,79],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png","bug-bounty","HackerOne Bug Bounty","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fbug-bounty-platform","Managed bug bounty and vulnerability disclosure programmes.",{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":35,"product_name":36,"url":37,"description":38},"pentest","HackerOne Pentest","https:\u002F\u002Fwww.hackerone.com\u002Fproduct\u002Fpentest","Penetration testing delivered by vetted researchers.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":43,"product_name":44,"url":45,"description":46},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png","nodezero","NodeZero","https:\u002F\u002Fhorizon3.ai\u002Fnodezero\u002F","Continuous autonomous penetration testing of internal and external networks, cloud, Kubernetes and web applications, showing which attack paths work and checking that fixes hold.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"intigriti","Intigriti","\u002Fvendor-logos\u002Fintigriti.png","intigriti-bug-bounty","Intigriti Bug Bounty","https:\u002F\u002Fwww.intigriti.com\u002F","Bug bounty, vulnerability disclosure and hybrid pentesting with a European researcher community.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"pentera","Pentera","\u002Fvendor-logos\u002Fpentera.png","pentera-platform","Pentera Platform","https:\u002F\u002Fpentera.io\u002Fpentera-platform\u002F","Runs automated, safe attacks in production to validate exploitable attack paths, prioritise proven risk and confirm fixes. Modules cover internal networks, the external attack surface and cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png","picus-autonomous-penetration-testing","Picus Autonomous Penetration Testing","https:\u002F\u002Fwww.picussecurity.com\u002Fplatform\u002Fautonomous-penetration-testing","Automated penetration tests that prove which weaknesses are actually exploitable, so fixing can focus on real risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"safebreach","SafeBreach","\u002Fvendor-logos\u002Fsafebreach.png","safebreach-propagate","SafeBreach Propagate","https:\u002F\u002Fwww.safebreach.com\u002Fpropagate-attack-path-validation\u002F","Automated penetration testing that emulates lateral movement, privilege escalation and credential harvesting to show how far a breach could spread.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"yeswehack","YesWeHack","\u002Fvendor-logos\u002Fyeswehack.png","yeswehack-bug-bounty","YesWeHack Bug Bounty","https:\u002F\u002Fwww.yeswehack.com\u002F","Bug bounty, vulnerability disclosure and pentest management.",{"total":88,"last_days":89,"recent":90},16,5,[91,96,101,106,111,116,121,126],{"slug":92,"title":93,"published_at":94,"brief":95},"an-ai-agent-found-a-critical-otp-bypass-in-production-the-attack-was-the-easy-pa-7b712b","An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.","2026-10-14T11:00:00+00:00","AI pentesting agent discovers critical OTP bypass vulnerability on an insurer's production website.",{"slug":97,"title":98,"published_at":99,"brief":100},"what-is-agentic-pentesting-what-it-proves-and-where-it-stops-b3468b","What Is Agentic Pentesting? What It Proves, and Where It Stops.","2026-10-07T11:42:24+00:00","Agentic pentesting offers autonomous attack path discovery and exploitation.",{"slug":102,"title":103,"published_at":104,"brief":105},"ciso-s-expert-guide-to-agentic-pentesting-for-websites-3cc3e4","CISO's Expert Guide to Agentic Pentesting for Websites","2026-09-17T10:50:53+00:00","New guide explores how autonomous AI agents can improve website pentesting speed.",{"slug":107,"title":108,"published_at":109,"brief":110},"ai-changed-the-exposure-problem-validation-needs-to-change-with-it-d82614","AI Changed the Exposure Problem. Validation Needs to Change With It.","2026-09-14T11:58:00+00:00","AI accelerates vulnerability discovery, necessitating new validation methods for defenders.",{"slug":112,"title":113,"published_at":114,"brief":115},"flaws-in-passkey-implementation-show-old-attacks-still-work-eae799","Flaws in Passkey Implementation Show Old Attacks Still Work","2026-07-22T23:50:01+00:00","Microsoft passkey implementation flaws allow old attacks to impersonate privileged users.",{"slug":117,"title":118,"published_at":119,"brief":120},"you-don-t-have-to-run-an-exploit-to-know-if-you-re-vulnerable-40e0a1","You Don't Have to Run an Exploit to Know If You're Vulnerable","2026-07-14T14:00:10+00:00","Picus explains TTP chaining to validate exploitability without running live exploits.",{"slug":122,"title":123,"published_at":124,"brief":125},"claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-fest-a0af3f","Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival","2026-07-01T10:00:00+00:00","AI tool Claude Opus 4.7 helped researcher find vulnerability in Front Gate Tickets website.",{"slug":127,"title":128,"published_at":129,"brief":130},"the-exploit-doesn-t-exist-you-can-still-prove-it-works-against-you-ebd832","The Exploit Doesn't Exist. You Can Still Prove It Works Against You","2026-06-23T14:01:11+00:00","AI accelerates vulnerability weaponization, outpacing patching and demanding new validation methods.",[132,136,140,144,148,152],{"slug":133,"title":134,"published_at":135},"ai-agent-exposes-critical-otp-bypass-in-live-insurance-portal","AI Agent Exposes Critical OTP Bypass in Live Insurance Portal","2026-10-14T12:21:03.121+00:00",{"slug":137,"title":138,"published_at":139},"agentic-pentesting-exposes-gaps-in-continuous-vulnerability-validation","Agentic Pentesting Exposes Gaps in Continuous Vulnerability Validation","2026-10-07T14:22:38.831+00:00",{"slug":141,"title":142,"published_at":143},"attackers-exploit-vulnerabilities-8x-faster-than-organizations-can-patch","Attackers Exploit Vulnerabilities 8x Faster Than Organizations Can Patch","2026-09-17T14:22:50.313+00:00",{"slug":145,"title":146,"published_at":147},"ai-is-flooding-defenders-with-cves-prioritization-must-evolve","AI Is Flooding Defenders With CVEs — Prioritization Must Evolve","2026-09-14T14:22:57.099+00:00",{"slug":149,"title":150,"published_at":151},"old-attack-techniques-undermine-new-passkey-authentication","Old Attack Techniques Undermine New Passkey Authentication","2026-07-23T12:21:44.031+00:00",{"slug":153,"title":154,"published_at":155},"ai-accelerated-exploits-demand-smarter-vulnerability-validation","AI-Accelerated Exploits Demand Smarter Vulnerability Validation","2026-07-14T14:20:20.915+00:00",[157,160,164],{"slug":23,"name":158,"problem":159},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":161,"name":162,"problem":163},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":165,"name":166,"problem":167},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"hackerone\u002Fbug-bounty":169,"hackerone\u002Fpentest":180,"intigriti\u002Fintigriti-bug-bounty":185,"yeswehack\u002Fyeswehack-bug-bounty":192,"safebreach\u002Fsafebreach-propagate":199,"pentera\u002Fpentera-platform":209,"horizon3-ai\u002Fnodezero":219,"picus-security\u002Fpicus-autonomous-penetration-testing":230},{"hq_country":170,"also_provides":171,"reviews":172,"affected":179,"reported":179},"US",[],[173,176],{"label":174,"url":175},"PeerSpot: HackerOne user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fhackerone-reviews",{"label":177,"url":178},"Gartner Peer Insights: HackerOne user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fhackerone",0,{"hq_country":170,"also_provides":181,"reviews":182,"affected":179,"reported":179},[],[183,184],{"label":174,"url":175},{"label":177,"url":178},{"hq_country":186,"also_provides":187,"reviews":188,"affected":179,"reported":179},"BE",[],[189],{"label":190,"url":191},"Gartner Peer Insights: Intigriti user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fintigriti",{"hq_country":193,"also_provides":194,"reviews":195,"affected":179,"reported":179},"FR",[],[196],{"label":197,"url":198},"Gartner Peer Insights: YesWeHack user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fyeswehack",{"hq_country":170,"also_provides":200,"reviews":202,"affected":179,"reported":179},[201],{"slug":165,"name":166},[203,206],{"label":204,"url":205},"CSO Online: Buyer’s guide: Breach and attack simulation (BAS) tools (2024)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F2132289\u002Fbreach-and-attack-simulation-tools.html",{"label":207,"url":208},"Gartner Peer Insights: SafeBreach Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fsafebreach-platform",{"hq_country":170,"also_provides":210,"reviews":212,"affected":179,"reported":179},[211],{"slug":165,"name":166},[213,216],{"label":214,"url":215},"Gartner Peer Insights: Pentera Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpentera-platform",{"label":217,"url":218},"PeerSpot: Pentera user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpentera-reviews",{"hq_country":170,"also_provides":220,"reviews":222,"affected":179,"reported":229},[221],{"slug":165,"name":166},[223,226],{"label":224,"url":225},"Gartner Peer Insights: NodeZero user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fnodezero",{"label":227,"url":228},"PeerSpot: The NodeZero Platform by Horizon3.ai user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fthe-nodezero-platform-by-horizon3-ai-reviews",4,{"hq_country":170,"also_provides":231,"reviews":233,"affected":179,"reported":241},[232],{"slug":165,"name":166},[234,237,240],{"label":235,"url":236},"Gartner Peer Insights: Picus Security Validation Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fpicus-security-validation-platform",{"label":238,"url":239},"PeerSpot: Picus Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fpicus-security-reviews",{"label":204,"url":205},2]