Supplying the Ministry of Defence? Which DCC level your contracts need, and what to do next.
Read itMuch of a traditional penetration test isn’t testing: it’s scanning, waiting and writing reports. Why that happens, what “penetration test” should mean, and seven questions to ask before you buy one.
Tom Reynolds
The sections that make a report useful, and the warning signs of one that isn't.
Tom Reynolds
Who sets your level, what each one requires, and what to do if a contract already asks for it.
Tom Reynolds
What each one checks, who usually asks for which, and how to prepare so you pass first time.
Tom Reynolds
A technical guide for developers and IT teams: the fixed versions for Node.js, Bun, .NET, Python, Envoy, Istio and Brotli itself, how to find every copy in your stack, how to stop decoding untrusted Brotli while you patch, and how to prove the fix is live.
Tom Reynolds
Eight practical ways to reduce website exposure, protect recovery options and verify the controls your business depends on.
Tom Reynolds
AI didn’t create the vulnerabilities surfacing this autumn. It made looking for them cheap. Why the spike in disclosures is an immune response, not a collapse, and what recovery looks like.
Tom Reynolds
A critical flaw in Brotli, the compression code inside Node.js, Python and much of the software that speaks HTTP, can let an attacker run code without logging in. What is affected, what to do this week, and why an AI found it first.
Tom Reynolds
What October 2026’s PHP, OpenCode, Railway and LiteLLM disclosures reveal about application exposure, credential risk and adversarial testing.
Tom Reynolds
A 30-minute call, a straight answer, and a fixed quote if there's work to do.
→Contact
A tender deadline, an insurer's questionnaire, a system you want tested, or a job you'd like AI to take off your team's hands. We reply within one working day, UK hours.
