Pentest team performance
Understand where delivery gets stuck, why reports keep returning and what the team can change.
Explore topicTopic guides
Browse by subject.
Each guide explains the subject and groups the relevant articles.
Reporting and QA
Write findings the evidence supports and recommendations the client can act on.
Explore topicConsultant development
Help testers grow through practice with reports, client conversations and the decisions behind them.
Explore topicOffensive security leadership
Make room for leadership, support the team and reduce the decisions that keep returning to the same people.
Explore topicLatest articles
Recently published articles.
Written by Simon Chapman for the people managing offensive security delivery.
The first 100 days of integrating acquired pentest businesses
A practitioner guide for investors and acquiring groups: connect delivery cover, scope, pricing, reviewer capacity and client ownership before standardising.
Read article
Why judgement may become the defining skill in offensive security
An automated workflow can continue collecting evidence after a weakness is proven. The tester still needs to decide whether further work is justified.
Read article
What fractional offensive security leadership actually means
How to define part-time head of penetration testing or pentest practice leadership support, with agreed authority, availability and internal responsibilities.
Read article
How to measure penetration testing team performance
Choose a few defined measures to investigate a delivery problem, then use the results to decide what the pentest team should change.
Read article
Why senior pentesters become the delivery bottleneck
How to identify routine work collecting around senior pentesters and transfer it safely to team leads and developing consultants.
Read article
How poor client communication erodes pentest margin
Follow an illustrative fixed-price engagement through access delays and report revisions to see where unplanned delivery time accumulates.
Read article
What good QA looks like in a penetration testing team
Apply AC/DC to pentest QA, with worked examples of vague recommendations and claims that go beyond the evidence.
Read article
How poor scoping damages penetration testing delivery
Missing access and unclear coverage become delivery decisions once a test starts. Agree the prerequisites and what happens if they cannot be met.
Read article
How AI changes the junior pentester role
A supervised finding-writing exercise shows how junior pentesters can use AI assistance while learning to check every claim against their evidence.
Read article
How penetration testing teams should handle severity disputes
A practical process for reviewing a challenged severity rating, including new client evidence and a single record of the final decision.
Read article
Why technical training does not fix every pentest team problem
Use recurring QA defects to decide whether a tester needs technical training, supervised practice or a change to the delivery process.
Read article
Why technical pentesters need consulting skills
A disputed finding shows why pentesters need to explain their evidence and work through client context before agreeing a conclusion.
Read article
Leadership Support
Want to talk through a problem in your team?
Tell us where the work is getting difficult. We can help you understand what is happening and decide what to do next.