Pentest team performance
How managers use delivery records to investigate delays and recurring quality problems.
Explore topicTopic guides
Browse by subject.
Each guide explains the subject and groups the relevant articles.
Reporting and QA
How testers support findings with evidence and give clients recommendations they can use.
Explore topicConsultant development
How testers practise report writing and client explanation, with feedback on their decisions.
Explore topicOffensive security leadership
How managers allocate delivery responsibilities and plan the support their testing teams need.
Explore topicLatest articles
Recently published articles.
Written by Simon Chapman for the people managing offensive security delivery.
Why judgement may become the defining skill in offensive security
An automated workflow can continue collecting evidence after a weakness is proven. The tester still needs to decide whether further work is justified.
Read article
What fractional offensive security leadership actually means
How to define a part-time leadership role for a pentest team, including its authority, working arrangements and handover to internal managers.
Read article
How to measure penetration testing team performance
Choose a few defined measures to investigate a delivery problem, then use the results to decide what the pentest team should change.
Read article
Why senior pentesters become the delivery bottleneck
How to identify routine work collecting around senior pentesters and transfer it safely to team leads and developing consultants.
Read article
How poor client communication erodes pentest margin
Follow an illustrative fixed-price engagement through access delays and report revisions to see where unplanned delivery time accumulates.
Read article
What good QA looks like in a penetration testing team
Apply AC/DC to pentest QA, with worked examples of vague recommendations and claims that go beyond the evidence.
Read article
How poor scoping damages penetration testing delivery
Missing access and unclear coverage become delivery decisions once a test starts. Agree the prerequisites and what happens if they cannot be met.
Read article
How AI changes the junior pentester role
A supervised finding-writing exercise shows how junior pentesters can use AI assistance while learning to check every claim against their evidence.
Read article
How penetration testing teams should handle severity disputes
A practical process for reviewing a challenged severity rating, including new client evidence and a single record of the final decision.
Read article
Why technical training does not fix every pentest team problem
Use recurring QA defects to decide whether a tester needs technical training, supervised practice or a change to the delivery process.
Read article
Why technical pentesters need consulting skills
A disputed finding shows why pentesters need to explain their evidence and work through client context before agreeing a conclusion.
Read article
Leadership Support
Discuss a problem raised by your team's work.
We can help examine recurring delivery problems and agree the support needed to address them.