Field notes on proof. How modern pentesting actually works.
Practical writing — no fluff, no fear-selling — on scoping, reproduction, evidence, coverage and AI-agent security, from the team building SuperPentest. If a post makes a claim, it shows the mechanism behind it.
From scope to evidence: a practical pentest roadmap
The seven stages that take an engagement from a signed scope to a finding you can act on — and why the value is concentrated in the reproduction and evidence steps most tests skip.
27 October 2026 · 7 min read PlaybookHow to scope a pen test for web apps, APIs and AI agents
Scoping decides what a test can find. A practical guide to the identities and tenants to supply, the three surfaces to name, and the rules of engagement that make production safe to test.
27 October 2026 · 6 min read ReferenceThe vulnerability classes every pentest should cover in 2026
The 35 classes a modern test has to reach, grouped into seven reachability families — and exactly where a signature-based scanner runs out of room in each one.
27 October 2026 · 8 min read Intro guideAn introductory guide to prompt injection and MCP security testing
Direct vs indirect injection, why an agent's tools turn a sentence into an action, what MCP changes about blast radius, and how you test for it with benign canaries.
27 October 2026 · 7 min read ComplianceHow to map pentest findings to OWASP, SOC 2, ISO 27001 and PCI
Auditors want each finding tied to the control it exercises. How one verified finding fans out across four frameworks at once — with correct, conservative example mappings.
27 October 2026 · 6 min read Decision guideDeep vs Standard: which pentest your security maturity needs
Not a sales page. What a Standard coverage scan and a Deep assessment each actually cover, and which fits a first pentest, an annual requirement, or a continuous program.
27 October 2026 · 6 min read PlaybookWhat makes a trust page useful for auditors and compliance
Who actually reads a trust page, the six things that make one useful, and how a genuine one differs from a logo-wall that proves nothing to a skeptical reviewer.
27 October 2026 · 6 min read