Blog
Practical insights on penetration testing, compliance, AI security and human risk.
DNSSEC: signed, half-signed, or broken
Every visit to your site and every email to your domain begins with a DNS lookup, and by default nothing proves the answer came from you. DNSSEC fixes that — but the two ways it commonly goes wrong are worse than never turning it on, and neither one shows up anywhere you would look.
Read →2026-08-28See what your business exposes online
Most organisations can list their main website. Far fewer can list the staging site a contractor put up in 2023, the old mail gateway, or whether somebody can forge an email that appears to come from the finance team. ClickScan is now open in beta to everyone.
Read →2026-08-28Graded recon, and a report for clients
Recon and client work look like different problems until you notice they need the same thing: a fast, honest read of what a domain exposes to the internet, and a way to write it down that somebody else will believe. ClickScan is now open in beta to everyone.
Read →2026-08-28ClickScan for MSPs: one org per client
Anyone can point a scanner at a client domain. The work is turning what comes back into something the client will read, believe and act on — and doing that for the twelfth client of the month without it becoming a second job. ClickScan is now open in beta to everyone.
Read →2026-08-28What a TLS check actually tests
A padlock in the address bar means the connection is encrypted. It does not mean the certificate is trusted by everyone, that old protocols are switched off, or that the server is not vulnerable to attacks with names like POODLE and Heartbleed. Here is what a real TLS check looks at.
Read →2026-08-28The subdomains you forgot you had
The staging site from a redesign, the old mail gateway, the subdomain a contractor pointed at a cloud service in 2019 that nobody has paid for since. An attacker does not start with your main domain — they start with everything else, because the least-maintained thing you own is the easiest way in.
Read →2026-08-28What an open port scan really shows
An open port is not a vulnerability. It is a service reachable from the internet, and the question is whether you meant it to be. Most of what a port scan finds is a database, a management interface or a remote-access service that was never supposed to face outward.
Read →2026-08-28Look-alike domains: which ones matter
Thousands of domains resemble yours. Almost all are parked, unused or owned by someone with no interest in you. The question is not how many exist — it is which ones can send email, serve a website, or otherwise do something. Here is how the check decides.
Read →2026-08-28HTTP security headers, explained
Security headers are a handful of lines your server sends with every page, and they decide whether a browser will run injected scripts, let your site be framed by somebody else, or quietly announce which version of PHP you are running. Here is what each one does.
Read →2026-08-28Can someone forge email from your domain?
You can read your SPF and DMARC records and conclude that spoofing is blocked. The only way to know is to send a forged message and see what happens — which is what this check does, and why it reports a refusal for the wrong reason as inconclusive rather than as a pass.
Read →2026-08-28What breach exposure actually tells you
A breach check does not mean your systems were compromised. It means an address of yours appeared in somebody else's leak — and what matters is which types of data that leak contained, because a password reused across services is a different problem from a leaked phone number.
Read →2026-08-28SPF, DKIM and DMARC: what each does
Three DNS records decide whether anyone can send email that appears to come from your domain. They are usually explained as one blob of jargon, so here is what each one actually does, in the order they were invented and the order you should fix them.
Read →2026-08-27EASM: what you expose to the internet
Most organisations can list their main website. Far fewer can list the staging site, the old gateway, the host still pointing at a cloud service nobody pays for, or the domain somebody registered last week to look like theirs. That gap has a name — external attack surface management — and this is what it actually involves, check by check.
Read →2026-08-27Update: ClickScan is live and open to everyone
ClickScan is live and open to everyone. Originally published as a preview in July, this post has been updated now that the platform is running in production — including the checks that have shipped since.
Read →2026-08-2684% have broken email authentication, 1.7% can receive a bug report — a full census of 915 critical infrastructure operators
A full-universe census of every organisation Chile's regulator designated as critical infrastructure found email-authentication misconfiguration in 766 of 915 of them, and a working vulnerability-disclosure contact at 16. Being named critical infrastructure by a regulator changed nothing about what these organisations publish in DNS. Here is what to check on your own domain.
Read →2026-08-19Your TLS certificates now expire in 200 days — and 100 in March 2027
The CA/Browser Forum cut the maximum certificate lifetime from 398 days to 200 on 15 March 2026, with 100 days coming in 2027 and 47 in 2029. Manual renewal was already fragile at once a year. Here is what changed, which certificates people forget they own, and how to audit yours before one of them takes a service down.
Read →2026-08-19CVE-2026-15748 (CVSS 9.8): the Forminator file-upload flaw that gives unauthenticated visitors code execution on your WordPress site
A two-stage blocklist bypass in Forminator Forms lets any visitor upload a PHP webshell — no login, no token, no prior foothold. Around 300,000 of the plugin's 600,000 installations were still unpatched at disclosure. Here is what to do after updating, and why file-upload endpoints need more than a version check.
Read →2026-08-19Your DMARC record does nothing — 56% of domains that have one are still at p=none
Publishing a DMARC record takes five minutes and stops exactly zero spoofed emails. Of the 937,931 top domains with a valid record in early 2026, 525,996 are still at p=none. Here are the four misconfigurations that keep organisations parked there forever, and how to check your own domain in about a minute.
Read →2026-08-11Your dashboard is a database with a login page — the Metabase zero-day
A CVSS 10.0 SQL injection flaw in Metabase was exploited before anyone knew it existed. It handed attackers admin access — and the credentials to every database the dashboard was connected to. Framework and Tally have already confirmed customer data was taken. Here is what to patch, what to rotate, and how to find the internal tools you forgot were online.
Read →