Pentest reporting, attack techniques and the day-to-day work of security teams.https://www.pentestpad.comhttps://www.pentestpad.com/blog/how-to-scope-a-pentesthttps://www.pentestpad.com/blog/how-to-scope-a-pentestPentest scoping over email spreads the details across inboxes, and some only turn up mid-test. A scoping questionnaire collects them in one place.Wed, 14 Oct 2026 00:00:00 GMTIlija LekoInsightshttps://www.pentestpad.com/blog/introducing-proposals-create-pentest-proposals-in-minuteshttps://www.pentestpad.com/blog/introducing-proposals-create-pentest-proposals-in-minutesYou can now write and price pentest proposals directly in PentestPad - line items, live document preview, PDF and DOCX export. Here's how it works and why we built it.Fri, 02 Oct 2026 00:00:00 GMTLuka ŠikićProduct Updateshttps://www.pentestpad.com/blog/plextrac-acquisitionhttps://www.pentestpad.com/blog/plextrac-acquisitionPlexTrac was acquired by Brinqa on August 19, 2026. What the PlexTrac acquisition changes for consultancies, the questions to ask before renewal, and how to export your data.Mon, 24 Aug 2026 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/introducing-subprojects-enhanced-pentest-organizationhttps://www.pentestpad.com/blog/introducing-subprojects-enhanced-pentest-organizationDiscover how PentestPad's new subprojects feature transforms how security teams organize and manage large-scale, multi-faceted penetration testing engagements.Mon, 25 May 2026 00:00:00 GMTLuka ŠikićProduct Updateshttps://www.pentestpad.com/blog/scaleway-partnership-eu-sovereigntyhttps://www.pentestpad.com/blog/scaleway-partnership-eu-sovereigntyWe're excited to announce our partnership with Scaleway as part of their Founders Startup Program, reinforcing our commitment to EU data sovereignty and compliance for penetration testing operations.Mon, 11 May 2026 00:00:00 GMTLuka ŠikićCompany Newshttps://www.pentestpad.com/blog/ai-in-pentesting-2026https://www.pentestpad.com/blog/ai-in-pentesting-2026Artificial intelligence has been about to transform cybersecurity for several years running. Explore what AI is actually good at in pentesting.Mon, 04 May 2026 00:00:00 GMTLuka ŠikićTechnicalhttps://www.pentestpad.com/blog/vulnerability-assessment-vs-penetration-testinghttps://www.pentestpad.com/blog/vulnerability-assessment-vs-penetration-testingVulnerability assessment vs penetration testing: what each actually does, where they overlap, when to use which, and why mature security programs always run both.Wed, 15 Apr 2026 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/best-pentest-reporting-tools-2026https://www.pentestpad.com/blog/best-pentest-reporting-tools-2026Honest 2026 comparison of the best pentest reporting tools — PentestPad, PlexTrac, PenReport, Cyver Core, GhostWriter, Pwndoc, Dradis and more.Tue, 14 Apr 2026 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/function-poisoning-hijacking-ai-agent-tool-executionhttps://www.pentestpad.com/blog/function-poisoning-hijacking-ai-agent-tool-executionWe watched an AI agent hack itself during a pen test. Here's why trusting API responses without verification is dangerous—and how one malicious server turned 'ls -la' into a reverse shell.Tue, 14 Oct 2025 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/audit-ready-cybersecurity-toolshttps://www.pentestpad.com/blog/audit-ready-cybersecurity-toolsCertain tools can prove that the job was done correctly, consistently, and transparently. They are actually able to make your audit preparations easier, and your company automatically compliant to certain requirements.Mon, 23 Jun 2025 00:00:00 GMTMirna NovakInsightshttps://www.pentestpad.com/blog/how-often-to-perform-a-pentesthttps://www.pentestpad.com/blog/how-often-to-perform-a-pentestKnowing when to test is as important as what to test. Here’s a breakdown of industry-standard set expectations and norms and why each matters.Thu, 12 Jun 2025 00:00:00 GMTMirna NovakInsightshttps://www.pentestpad.com/blog/free-pentest-report-wordhttps://www.pentestpad.com/blog/free-pentest-report-wordLearn what makes a professional pentest report and download a free template. Plus, how to automate reporting with PentestPad.Thu, 05 Jun 2025 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/client-spotlight-why-bitcube-security-trusts-pentestpadhttps://www.pentestpad.com/blog/client-spotlight-why-bitcube-security-trusts-pentestpadWe had the pleasure of talking to BitCube CEO Luca Epifanio - a cyber expert, offsec instructor and ethical hacker. Check out how they use PentestPad as internal pentest platform and how it helps them automate reporting.Mon, 26 May 2025 00:00:00 GMTMirna NovakClient Spotlighthttps://www.pentestpad.com/blog/attacking-2fa-in-modern-web-applicationshttps://www.pentestpad.com/blog/attacking-2fa-in-modern-web-applicationsExplore the most common two-factor authentication bypass techniques in modern web apps, from SIM swapping to real-time phishing, and learn how to defend against them.Sat, 17 May 2025 00:00:00 GMTLuka ŠikićTechnicalhttps://www.pentestpad.com/blog/pentest-v1-releasehttps://www.pentestpad.com/blog/pentest-v1-releaseDiscover what’s new in PentestPad: a redesigned UI, smarter reporting, better project management, and improved collaboration—built with real feedback from pentesters to improve the entire assessment lifecycleTue, 13 May 2025 00:00:00 GMTLuka ŠikićInsightshttps://www.pentestpad.com/blog/the-hidden-cost-of-manual-pentest-reportinghttps://www.pentestpad.com/blog/the-hidden-cost-of-manual-pentest-reportingManual pentest reporting wastes time, reduces efficiency, and hurts team morale. PentestPad automates this process with templates, auto-inserted evidence, and one-click report generation—saving hours, improving quality, and scaling your operations.Thu, 10 Apr 2025 00:00:00 GMTMirna Novakinsighthttps://www.pentestpad.com/blog/what-to-include-in-a-professional-pentest-report-a-complete-guidehttps://www.pentestpad.com/blog/what-to-include-in-a-professional-pentest-report-a-complete-guideA professional pentest report is key to proving value, guiding remediation, and maintaining credibility. It should include an executive summary, findings, risk summaries, and clear remediation steps. With tools like PentestPad, you can automate theSat, 05 Apr 2025 00:00:00 GMTMirna Novakinsighthttps://www.pentestpad.com/blog/tasks-collaboration-on-pentest-project-lifecyclehttps://www.pentestpad.com/blog/tasks-collaboration-on-pentest-project-lifecyclePentestPad’s Tasks feature simplifies pentest project management with a smart Kanban board, task-based collaboration, searchable logs, and built-in comments—making teamwork seamless, updates clear, and project insights easy to retain.Wed, 02 Apr 2025 00:00:00 GMTLuka Šikićinsighthttps://www.pentestpad.com/blog/http-hijacking-through-cross-site-scriptinghttps://www.pentestpad.com/blog/http-hijacking-through-cross-site-scriptingDuring a recent assessment, we identified a low-impact Cross-site Scripting (XSS) vulnerability. While HttpOnly cookies typically protect against unauthorized access to authentication cookies, there's a way to escalate the impact of such vulnerabilities.Sat, 29 Mar 2025 00:00:00 GMTMirna Novakinsight