How we prove what we find.
Methods, teardowns and notes from the engine — on testing web apps, APIs and the AI inside your product, and on the one thing that separates a finding from a guess: reproducing it.
AI & agent security
AI agent penetration testing: prompt injection, MCP, tool boundaries
The pillar: how we test the AI inside your product like an attacker will — the attack surface of an AI feature, prompt injection, tool-call and permission boundaries, MCP servers, and why every result is proven with a canary rather than a screenshot.
Proving a second-order prompt injection with a planted canary
A model saying something strange is not proof it was injected. The canary method turns an indirect prompt injection into reproducible evidence: a unique value planted in data the agent later reads, so that if it surfaces in the agent's action, there is only one way it could have got there.
Access control
The access-control bug a scanner cannot find
Broken access control is the most common serious web risk and the one a scanner structurally cannot see — nothing about the request is malformed. We prove it by replaying the same request as every identity and comparing the answers to the rule: control refused, test allowed, reproduced.
Business logic vulnerabilities: the bugs only your app can have
Negative quantities, skipped payment steps, coupons redeemed twice in a race — logic flaws break the rules of your business, not of HTTP, so no scanner signature fires. How we test them against your application's own rules.
Method & trust
How a candidate becomes a finding
A signal is a lead; a finding is proven. The reproduction discipline that turns a tool hit or a model assertion into a confirmed finding — clean-session proof, two-sided evidence, and holding back the unproven.
Compare & learn
AI penetration testing vs a vulnerability scanner
An honest account of what a scanner does well, where it structurally stops, and what an autonomous AI pentest adds — breadth and alerts versus depth and proof, and why most teams want both.
Continuous penetration testing for SOC 2, ISO 27001 & more
A once-a-year pentest leaves every release between audits untested. How continuous testing re-runs the same investigation on every change and maps each finding to the control it breaks across SOC 2, ISO 27001, PCI-DSS, NIS2 and DORA.
Best AI penetration testing tools in 2026
A sourced, fair comparison of SuperPentest, XBOW, Hadrian, Aikido and Escape — autonomy, web and API coverage, authenticated and business-logic testing, AI-agent testing, evidence validation and EU hosting.
Autonomous penetration testing: what it is and how it works
The category explained — how autonomous testing differs from scanners and human pentests, and what to require before trusting a finding no person signed off in the moment.
AI penetration testing tools in Europe
EU-based and EU-hosted options, and what data residency means under GDPR, NIS2 and DORA — including where SuperPentest runs (AWS Frankfurt).
The penetration testing glossary
Plain definitions of IDOR, BOLA, broken access control, prompt injection, second-order injection, MCP, DAST and PTaaS — with a link to how we test each.
More teardowns are on the way — on how a candidate becomes a finding, on MCP and tool-call boundaries, and on business-logic abuse. Want one on a specific class? Tell us.