60 breaches in six weeks: what South Korea's AI hacking case means for you
Police say one attacker used AI tools to breach 60 organisations in six weeks. What really happened, and what UK businesses should do about it.
Zarco
Zarco / Blog
Guides on compliance, testing and AI.
Straight answers to the questions we hear on calls, written for the people who have to make the decision.
All articles
What you’re really paying for in a penetration test
Much of a traditional penetration test isn’t testing: it’s scanning, waiting and writing reports. Why that happens, what “penetration test” should mean, and seven questions to ask before you buy one.
Tom Reynolds
What a penetration test report should include
The sections that make a report useful, and the warning signs of one that isn't.
Tom Reynolds
DCC Level 0 and Level 1, explained for MOD suppliers
Who sets your level, what each one requires, and what to do if a contract already asks for it.
Tom Reynolds
Cyber Essentials or Cyber Essentials Plus: which do you need?
What each one checks, who usually asks for which, and how to prepare so you pass first time.
Tom Reynolds
HTTP2Shell (CVE-2026-111497): how to find, patch and contain it
A technical guide for developers and IT teams: the fixed versions for Node.js, Bun, .NET, Python, Envoy, Istio and Brotli itself, how to find every copy in your stack, how to stop decoding untrusted Brotli while you patch, and how to prove the fix is live.
Tom Reynolds
Your website’s attack surface starts before your first visitor
Eight practical ways to reduce website exposure, protect recovery options and verify the controls your business depends on.
Tom Reynolds
The internet has a fever, and that’s a good sign
AI didn’t create the vulnerabilities surfacing this autumn. It made looking for them cheap. Why the spike in disclosures is an immune response, not a collapse, and what recovery looks like.
Tom Reynolds
HTTP2Shell: what the Brotli flaw (CVE-2026-111497) means for your business
A critical flaw in Brotli, the compression code inside Node.js, Python and much of the software that speaks HTTP, can let an attacker run code without logging in. What is affected, what to do this week, and why an AI found it first.
Tom Reynolds
Black October: AI, stolen secrets and the attack paths between them
What October 2026’s PHP, OpenCode, Railway and LiteLLM disclosures reveal about application exposure, credential risk and adversarial testing.
Tom Reynolds
Talk to us about AI, compliance or testing.
A 30-minute call, a straight answer, and a fixed quote if there's work to do.
→Contact
Tell us what you need.
A tender deadline, an insurer's questionnaire, a system you want tested, or a job you'd like AI to take off your team's hands. We reply within one working day, UK hours.
- A 30-minute first call, with no obligation
- A fixed quote before any work starts
- A UK-based team you can talk to directly