PROFESSIONALLY EVIL BLOG

We Break Things For a Living.

We Also Write About Things.

Our expert-led content ranges from deep-dives into penetration testing to explorations of hardware hacking. In this digital playground, we unravel the complex world of information security with a touch of fun. Whether you’re curious about Secure Ideas or passionate about cybersecurity, this blog is your quick, enlightening, and entertaining guide into the captivating world of information security. 

Professional Insights Blog

Latest Post

Password Vampires: Don’t Get Bitten Twice

With Halloween right around the corner, let’s talk about your dark secret from the distant past that could really come back to haunt you: that password you’ve been using since 2015. Don’t lie… You know the one.

...
Read More ›

All Entries

The AI Arms Race Just Went Public: What Project Glasswing Means for You

The AI Arms Race Just Went Public: What Project Glasswing Means for You

Anthropic's Project Glasswing signals a shift in cybersecurity, enabling advanced AI to identify vulnerabilities, urging organizations to adapt or fall behind....
Read ›
The Difference Between a Vulnerability Scan and a Penetration Test: Why It Matters for Compliance

The Difference Between a Vulnerability Scan and a Penetration Test: Why It Matters for Compliance

Understand the critical differences between vulnerability scans and penetration tests to ensure compliance with security frameworks and accurately assess your risk....
Read ›
The Secret Handshake – Covertly Redirecting Mobile Traffic to a Different Backend

The Secret Handshake – Covertly Redirecting Mobile Traffic to a Different Backend

Learn how to covertly redirect mobile app traffic to different backends during penetration tests, overcoming common challenges with Burp Suite and mitmproxy....
Read ›
Paths to Power in Active Directory Part 4: ESC3 – In The Name of The Crown

Paths to Power in Active Directory Part 4: ESC3 – In The Name of The Crown

Explore how misconfigured Active Directory Certificate Services can lead to privilege escalation through delegated authority, allowing low-privileged users to obtain Domain Admin access....
Read ›
Understanding MFA Fatigue Attacks

Understanding MFA Fatigue Attacks

Explore the risks of MFA fatigue attacks, how they exploit user psychology, and strategies to enhance security in your organization....
Read ›
Rolling for Resilience Part 4 Boots in the Field: Manuals for Real Time Action

Rolling for Resilience Part 4 – Boots in the Field: Manuals for Real-Time Action

Enhance cybersecurity incident response with actionable field guides that ensure quick, precise actions under pressure, transforming preparation into real-time strategic execution....
Read ›
Paths to Power in Active Directory Part 3: ESC2 – The Seal of Any Purpose

Paths to Power in Active Directory Part 3: ESC2 – The Seal of Any Purpose

Power in Active Directory, much like power in Westeros, often changes hands not through force, but through misplaced trust....
Read ›
Supply Chain Security: Trust Is the New Attack Surface

Supply Chain Security: Trust Is the New Attack Surface

Securing the software supply chain requires continuous validation of trust, not just reliance on outdated third-party risk practices....
Read ›
What factors impact the cost of an external penetration test

What factors impact the cost of an external penetration test?

This article describes the main factors that we take into consideration while estimating the cost of an external penetration test....
Read ›
SaaS Sprawl, Identity, and the Illusion of Control

SaaS Sprawl, Identity, and the Illusion of Control

Explore the inevitable SaaS sprawl and learn how continuous visibility and governance can ensure security in modern enterprises....
Read ›
Detecting Dangling SaaS Subdomains and Real Subdomain Takeovers

Detecting Dangling SaaS Subdomains and Real Subdomain Takeovers

Detecting and mitigating dangling SaaS subdomains and real subdomain takeovers with a more accurate, reliable tool to reduce false positives and build trust in security...
Read ›
AI Agents: Clippy With Root Access

AI Agents: Clippy With Root Access

AI agents are transforming productivity but pose serious security risks. Secure their access & treat them as high-risk systems to avoid potential breaches....
Read ›

Get the Debrief in Your Inbox

New findings, series updates, and usually some bad puns. Delivered when we actually have something worth saying.

No spam. Unsubscribe whenever. We’re evil, not rude.

This website uses cookies

We use cookies to personalize content, provide social media features, and analyze our traffic. We also share information about your use of our site with our analytics partners. You can change your preferences at any time. For more information, please see our Privacy Policy.