https://superpentest.com/blog Autonomous AI penetration testing — notes on reproduction-first security, AI/agent testing and compliance evidence. en https://superpentest.com/blog/vulnerability-classes-pentest-2026 https://superpentest.com/blog/vulnerability-classes-pentest-2026 2026-10-27T09:00:00+00:00 A senior reference to the vulnerability classes a modern penetration test has to reach — access control, authentication, injection, API contracts, business logic, exposure and the new AI-agent surface — grouped, with a note on why signature scanners miss the harder members and why coverage only counts when it is tested honestly. https://superpentest.com/blog/trust-page-for-auditors https://superpentest.com/blog/trust-page-for-auditors 2026-10-27T09:00:00+00:00 A security trust page is read by auditors, buyers' security teams and vendor-risk reviewers — not by your marketing team. Here is what makes one actually useful: current test status and dates, a scope statement, shareable evidence instead of badges, a stated verification method, findings tracked to closure, and honest disclosure — versus the logo-wall page that proves nothing. https://superpentest.com/blog/scope-to-evidence-pentest-roadmap https://superpentest.com/blog/scope-to-evidence-pentest-roadmap 2026-10-27T09:00:00+00:00 A field-tested roadmap for running a penetration test that ends in proof, not a PDF of maybes: how scope, rules of engagement, hypotheses, controlled tests, clean-session reproduction and hash-chained evidence fit together, stage by stage. https://superpentest.com/blog/prompt-injection-and-mcp-security-guide https://superpentest.com/blog/prompt-injection-and-mcp-security-guide 2026-10-27T09:00:00+00:00 A beginner-friendly, technically correct introduction to prompt injection and MCP security testing: direct vs indirect injection, why an agent's tools turn an injection into an action, permission boundaries, how an over-permissioned MCP surface widens the blast radius, and how you test for it with a benign canary. https://superpentest.com/blog/map-findings-to-compliance-controls https://superpentest.com/blog/map-findings-to-compliance-controls 2026-10-27T09:00:00+00:00 Auditors do not want a list of bugs; they want each one tied to the control it exercises. Here is how a single finding maps across OWASP, SOC 2, ISO 27001 and PCI DSS at once — with correct, conservative example mappings and where people get them wrong. https://superpentest.com/blog/how-to-scope-a-penetration-test https://superpentest.com/blog/how-to-scope-a-penetration-test 2026-10-27T09:00:00+00:00 A practical guide to scoping a penetration test that actually covers your attack surface: the identities and tenants to supply, how web apps, APIs and AI-agent surfaces each change the scope, and the rules of engagement that keep it safe. https://superpentest.com/blog/deep-vs-standard-pentest-plans https://superpentest.com/blog/deep-vs-standard-pentest-plans 2026-10-27T09:00:00+00:00 A decision guide, not a sales page: what a Standard coverage scan and a Deep assessment each actually cover, and which one fits your stage — first-ever pentest, an annual compliance requirement, or a continuous program.