NetSPI

NetSPI has expanded its continuous pen testing offerings to include web application, AI/ML, AI findings validation and internal network. Learn more → ow.ly/RC8x50ZlOqs #ContinuousTesting #PTaaS

Thousands of AI-generated findings won't tell you what risks are real. Our new Continuous AI Findings Validation service does. Experts verify severity and cut the noise so your team acts on what matters. Read more: ow.ly/zvOJ50Zloun #ContinuousTesting #PTaaS

We're expanding our continuous pentesting platform to include: Continuous Web App Testing, Continuous AI Testing, Continuous Internal Testing, and Continuous AI Findings Validation. More visibility. Less noise. Read more: ow.ly/lP2b50ZlouG #ContinuousTesting #PTaaS

New Hack Responsibly podcast episode 🎧 @kfosaaen talks to Giles Inkson about AI's impact on detection (including the false positives) and living off the land: why built-in OS tools still win. Listen here: ow.ly/CEti50Zgr0v #RedTeam #podcast #hackresponsibly

See you at TROOPERS26 on June 25 at 2:15pm in Track 2! NetSPI’s @kfosaaen and Thomas Elling will present: Modern Adventures in Azure Privilege Escalation. Don’t miss the talk to get an overview of Azure attack paths. Learn more: ow.ly/vYoH50Z8RA8

In his latest research, NetSPI's Thomas Byrne breaks down how Nested App Authentication (NAA) flows can be abused to bypass Microsoft Entra Conditional Access Policies entirely using the authentication flow working exactly as designed. Read more: ow.ly/TWtx50ZffNj

NetSPI's Karl Fosaaen & Thomas Elling are taking the stage at #TROOPERS26. Topic: Modern Adventures in Azure Privilege Escalation Initial access. Escalation. Lateral movement. Persistence. And a new resource for exploiting Azure attack paths: ow.ly/B0t050Z8RxM

Journalist pretext + ProtonMail + Evilginx AITM = C-suite exec forwarding your phish to two vendors. Rafael Seferyan, Principal Tech Lead at NetSPI wrote a blog detailing the whole thing: ow.ly/o3At50Ze190

PATCH NOW! CVE-2026-20253 Splunk Enterprise Unauthenticated Arbitrary File Operations / RCE. This vulnerability allows any network-reachable attacker to create or overwrite files on the server without credentials. Immediate action is necessary: ow.ly/ijNi50ZbY5n

MFA was a strong control in the environment. It was also the key to breaking it. Legacy NIS + Duo Auth Proxy + a RADIUS shared secret = full domain compromise. New technical blog walks the full attack chain from unauthenticated Apache NiFi RCE to DCSync: ow.ly/1qCO50Z92mM

NetSPI Labs Researcher, @WebbinRoot, talks today at 11:40am PT. Live stream his session on OCInferno, an enumeration and graphing framework using OpenGraph for BloodHound-style attack path analysis: lnkd.in/gAcBvNCf

Employees are trained to be skeptical of suspicious emails, but physical phishing vectors are a blind spot. Attackers are getting creative. See how a fortune cookie in a breakroom led to harvested employee credentials: ow.ly/ICJ250Z4PE0

Your external attack surface changes every time you deploy something new. Attackers notice. NetSPI's continuous external pentesting identifies and validates real risk across your internet-facing assets as they change, not months later: ow.ly/uNMQ50Z1aL1

Critical Drupal + PostgreSQL SQL injection critical vulnerability. Unauthenticated attackers can run arbitrary SQL queries, leading to full database compromise or RCE. Actively exploited in the wild. Patch now. ow.ly/NuyZ50Z4sCw #Drupal #CVE #proactivesecurity #PatchNow

Finding vulnerabilities is only half the battle. Getting them to the right team fast enough is where most programs break down. NetSPI's agentic MCP integrations automate that handoff, no manual data entry required. Learn more: ow.ly/3aik50Z1aHr

UEFI flaws hide before your OS even loads. NetSPI's Larry 'Patch' Trowell built a blueprint for finding them without physical hardware. Read more: ow.ly/nzg250Z2Rfr

New Hack Responsibly podcast episode 🎧 @kfosaaen talks to James Albany. Topics: continuous testing, AI in pentesting, overlooked attack surfaces, and breaking into a data center with a credit card. Listen here: ow.ly/jQzZ50Z2Gtb #podcast #hackresponsibly

Cloud misconfigurations don't wait for your next scheduled test. Neither should your security program. NetSPI's continuous cloud pentesting catches excessive permissions, exposed services, and misconfigurations as they emerge: ow.ly/rLsE50Z1aCa #CloudSecurity #Pentesting

Continuous pentesting keeps visibility current as your attack surface evolves. NetSPI finds real risk as it appears, not months later. Learn more: ow.ly/sN9n50YZ85s #continuouspentesting #proactivesecurity

Automation creates noise. Point-in-time testing leaves gaps. The answer is continuous, human-validated security testing. NetSPI's Continuous Pentesting finds and validates real risk as your environment changes. Read more: ow.ly/FYCZ50YY9Es