AI Security Scoping: Define What To Test In Your Deployment
Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration...
View ArticleBehind Closed Doors: How Physical Penetration Testing Secures Sensitive...
Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or...
View ArticleWhy the AI Attack Surface Extends Your Stack
Integrating AI into enterprise applications creates risk across every layer of the stack, not just the model. This post maps the full AI attack surface, shows how a prompt injection can chain into...
View ArticleSeparating Signal from Slop: Triaging CVEs in the Age of AI Security Research
AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured...
View ArticleCTEM 101: Moving From Spreadsheets to Continuous Risk Reduction
Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes...
View ArticleWhat Security Leaders Think About Frontier AI Models: Firsthand of Mythos
Frontier AI models are raising the ceiling for skilled attackers and lowering the bar for everyone else. Leaders from Vista Equity, Cisco, and Bishop Fox share what that shift looks like in practice,...
View ArticleNavigating Threats: Adopting Proactive Social Engineering and Network Testing...
Get insights from Bishop Fox experts on social engineering tactics, implementing technical controls, and the importance of internal network testing.
View ArticleStrengthening Cybersecurity Defenses: Validating Incident Response Plans with...
In this blog, learn how Bishop Fox Red Team tabletop exercises help organizations test Incident Response plans against tactics, techniques, and procedures used by attackers.
View ArticlePurple Teaming: Validating Cybersecurity Investments and Enhancing Efficiency
Learn how Purple Teaming brings together offensive and defensive strategies for a more comprehensive and impactful cybersecurity approach.
View ArticleHealthcare: 2023 Insights from the Ponemon Institute
Get insights into offensive security trends in the healthcare sector with data from the Ponemon Institute’s 2023 State of Offensive Security Report.
View ArticleRed Teaming: 2023 Insights from the Ponemon Institute
Learn why mature organizations turn to Red Teaming to improve cybersecurity resiliency.
View ArticleA Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
ManageEngine's SSO ticket was just the millisecond wall-clock time at login, making unauthenticated account takeover theoretically possible. Bishop Fox confirmed the exploit end to end and breaks down...
View ArticleIntroducing snowpick: Testing ServiceNow for Public Data Exposure
ServiceNow portals can expose backend records through public widgets and API endpoints even when the visible portal looks locked down. Bishop Fox built snowpick to test both surfaces systematically,...
View ArticleCracking Firmware with Claude: Senior-Level Skill, Junior-Level Autonomy
A senior Bishop Fox researcher once cracked SonicWall's proprietary firmware encryption by hand. We gave Claude the same problem, two artifacts, one instruction, and mostly got out of the way. What...
View ArticleOn Favicons: From Browser Icons to Attack Surface Intelligence
Favicons are small, static, and rarely changed, which makes them a surprisingly durable fingerprint for identifying software across the internet. Bishop Fox built an AI-assisted pipeline to hash and...
View ArticleAI Finds Vulnerabilities. Security Experts Find Impact.
AI got a security consultant 80% of the way through a real web application assessment. The other 20% was where the actual security work happened. This walkthrough shows where AI delivered, where it...
View ArticleThe Smash-and-Grab Era
We walk through three eras of cyber attacks and makes a troubling case that LLMs are removing the one constraint that kept attackers slow and detectable.
View ArticleEnabling Proper PCI Testing with Internal Penetration Tests
PCI DSS v4.0.1 made internal penetration testing more complex, bringing cloud infrastructure, SaaS apps, and build pipelines explicitly into scope. Derek Rush breaks down how to scope a compliant IPT,...
View ArticleMythos Doesn't Deploy Itself
AI is raising the ceiling for skilled researchers and flooding bug bounty programs with polished but inaccurate submissions at the same time. Both things are true, and the reconciling variable is the...
View ArticleIntroducing Joro: Using AI to Build Security Tooling
Bishop Fox is releasing Joro, a collaborative web exploitation framework built almost entirely with AI. From intercepting proxy to C2 integration, this post covers how it was built, what it does, and...
View Article
