The Role of AI in Penetration Testing
Bonnie Smyre shows how Raxis’ AI-augmented pentesting gives their expert pentesters more time for complex chained attacks and discovery of business-logic flaws.
Penetration Testing Blog
Offensive security, written by the professionals who live it.
CrowdStrike Fires Insider Who Shared Screens Externally
Though hacker groups claimed to have access to internal systems, CrowdStrike announced they fired an insider who shared external screens with the attackers.
Raxis Chief Technology Officer Brian Tant Featured on WSB-TV Atlanta
When WSB-TV Atlanta reached out to for help warning about a scam targeting Atlanta residents in DeKalb County, Raxis CTO Brian Tant jumped to help.
OWASP Top 10 for 2025: What’s New in Web Application Security
The OWASP Top 10 2025 for web applications release candidate was released last week. Take a look at which categories have moved as well as one new category.
Wireless Encryption: WPA3 and the Gotchas Every Company Should Know About
Brian Tant takes a look at WPA3. While offering much deeper security than WPA2, it is still vulnerable to transition Mode and side-channel attacks.
AI-Augmented Series: LLM-Aided Enumeration for Dormant WordPress Account Discovery
Ryan Chaplin leads off our Augmented-AI series with a scenario from a recent pentest using AI to write a script to discover an account to gain system access.
The @ctrl/tinycolor NPM Attack: The Brutal Anatomy of a Cascading Supply Chain Breach
Over 40 major packages were exploited in this malware campaign. Learn what happened and what your organization should do if you have been affected.
Why We Don’t Change Risk Ratings on Pentest Findings (Even When You Ask Nicely)
Raxis’ Tim Semchenko explains why we can’t lower risk ratings for your penetration test findings just because you ask and why that’s a good thing.
PSE & Red Team Series: Badge Cloning
Lead Penetration Tester Nathan Anderson is back with more PSE and red team advice, this time looking into three tools he uses to clone badges and gain access.
Windows Kills Common Offline/Account-less Install Method
Microsoft Windows recently announced the removal of local-only installs on Windows 11. Raxis’ Ryan Chaplin looks at concerns and possible options.
Salesforce Compromise: What You Need to Know
The FBI has released information to help organizations that are affected by recent attacks against Salesforce. Raxis’ Jason Taylor sums up next steps here.
SpamGPT: Protecting Your Company From Large-Scale Phishing
SpamGPT, a complex phishing and social engineering suite has made the news recently. Learn what it is and how organizations can protect their employees.
298 posts, newest first.