Home / Blog
The blog
Notes from building it.
Written by the people building the product, about the parts of it we have opinions on. No guest posts, no keyword pages, nothing we cannot show you in the console.
Posts
53 posts so far
The blog is new. These are the three arguments we make most often, written down properly so we can stop making them badly on calls.
Who can see what: the test your scanner cannot run
A scanner has one login, so there is one question it can never ask. What the access table is, why it needs five accounts, and what a single leaked square costs.
Why we publish what we miss
Every tool in this space leads with a big number. We could produce one this week and it would mean nothing. What we are measuring instead, and when it lands.
What belongs in a finding, and what does not
Request, response, screenshot, line of code. Anything missing one of those is a suspicion, and suspicions are the reason nobody reads the second report.
Black box vs white box penetration testing: which to choose
Black, grey and white box penetration testing compared: what each finds and misses, how effort differs, when to choose each and how to combine them.
What is VAPT? Vulnerability assessment and penetration testing, explained
What VAPT means, how vulnerability assessment differs from penetration testing, the process, the report, how often to test, and the India context.
Web application penetration testing: the 2026 guide
Scope, test types, the OWASP WSTG methodology, phases, timelines, report contents and retesting: how a web app pentest runs from start to finish.
Penetration testing cost in 2026: what drives it and how to compare quotes
What drives penetration testing cost in 2026: scope, accounts, test type, retests and compliance, plus pricing models and a checklist to compare quotes.
How to choose a penetration testing company: 20 questions, red flags and a report check
20 questions to ask, red flags, how to review a sample report, and what CREST, OSCP and CERT-In empanelment do and do not tell you.
CERT-In empanelled VAPT: who needs it, and how to check one
Who really needs a CERT-In empanelled VAPT, what the 2022 directions and 2025 audit guidelines say, how to verify an auditor, and what it does not guarantee.
SOC 2 penetration testing: is it required, and what do auditors expect?
Is a pentest required for SOC 2? What it supports, how to scope it, how often to run it and what evidence auditors expect.
PCI DSS penetration testing requirements: what Requirement 11.4 asks for
What PCI DSS v4.0.1 Requirement 11.4 asks for: frequency, segmentation, who can test, web application scope, retests and the evidence an assessor expects.
ISO 27001 penetration testing: what auditors expect in 2026
Is a pentest required for ISO 27001? What Annex A 8.8 and 8.29 ask for, how often to test, how to scope it, and the evidence pack an auditor will want.
DPDP Act security requirements: what Rule 6 and Rule 7 mean for app teams
DPDP Act security requirements in plain English: the Rule 6 safeguards, the 72-hour breach notice, the penalties and the evidence an app team should keep.
Continuous penetration testing: how to run it alongside your annual pentest
What continuous penetration testing really means, how it compares with annual pentests, DAST and PTaaS, and how to run both in your pipeline.
API security testing: a 2026 guide to the OWASP API Top 10
A step-by-step API security testing guide: the OWASP API Top 10 (2023) with test cases, BOLA and BFLA checks, JWT, OAuth, GraphQL and a CI/CD plan.
VAPT checklist for 2026: from scope to retest
The full VAPT checklist for 2026: scope, accounts, environment, report review, triage, fixes and retest, with tables and a one-page list to copy.
Pentest checklist for a web application (OWASP WSTG)
A pentest checklist for web applications mapped to the 12 OWASP WSTG categories, with pass criteria, evidence to keep and a retest step.
The IDOR checklist: how to test for insecure direct object references
An IDOR checklist for 2026: where object IDs hide, two-account tests, UUID and API cases, ownership-check fixes and regression tests.
Business logic testing checklist: prices, coupons, workflows and race conditions
A business logic testing checklist covering prices, quantities, coupons, workflows, limits, timing and race conditions, with test ideas and fixes.
Broken object level authorization (BOLA): examples, testing and fixes
Broken object level authorization (BOLA) explained: examples, BOLA vs IDOR, a two-account test, the ownership-check fix and code review questions.
Access control testing checklist: sideways, upward and across tenants.
A step-by-step access control testing checklist for web apps and APIs: account planning, sideways, upward and cross-tenant checks, evidence and retests.
How to read a penetration test report, and what to do next
A buyer's workflow for any penetration test report: sections, severity vs confidence, CVSS limits, evidence checks, triage and a remediation plan.
The vulnerability remediation process: from finding to proven fix
Triage, owner, SLA, fix, retest, close. A practical vulnerability remediation process with severity deadlines, risk acceptance and the metrics worth tracking.
Vibe coding security: risks, review steps and a launch checklist for 2026
Vibe coding security in 2026: the main risks in AI-generated apps, the data behind them, a review routine, guardrails and a launch checklist.
MCP security: threats, testing and a hardening checklist for 2026
MCP security in 2026: tool poisoning, token flaws and prompt injection, what the latest spec requires, a test plan and a hardening checklist.
AI agent security testing: a 2026 test plan for LLM apps and agents
AI agent security testing in 2026: a test plan for prompt injection, excessive agency, data leakage and cross-account access, mapped to OWASP.
DAST vs SAST vs IAST vs SCA: what each finds, what each misses, and how to combine them
DAST vs SAST vs IAST vs SCA compared: what each finds and misses, a comparison table, and the order to adopt them in a 2026 security programme.
AI penetration testing in 2026: what it can and cannot do
AI penetration testing in 2026: what it does well, where it fails, how accurate it is, and questions to ask before you trust a tool.
XBOW alternatives: ten options compared, and how to choose
XBOW alternatives for 2026: AI agents, human-led services and open-source tools compared from their own sources, with a table and a checklist to choose.
Best AI pentesting tools in 2026: ten compared, and how to choose
Ten AI pentesting tools compared from vendors' own sites, with a scoring sheet, a table by category and a plan for a fair trial on your own app.
Best DAST tools 2026: twelve compared and how to choose
Twelve DAST tools compared from vendor docs: authentication, APIs, CI/CD, proof and deployment, plus a decision table and a one-week bake-off.
Acunetix alternatives in 2026: nine options and how to choose
Acunetix alternatives compared from vendor docs: suites, developer-first DAST, open source and attack surface tools, plus how to switch safely.
Invicti vs Acunetix in 2026: what changed and how to choose
Acunetix is now Invicti Web + API. How the products relate, what each package covers, and a trial plan to choose, using vendor sources only.
Burp Suite vs OWASP ZAP in 2026: which one should you use?
Burp Suite vs OWASP ZAP compared from vendor docs: manual testing, CI/CD, logins, APIs, scale, and a six-point way to choose. No prices.
Burp Suite Enterprise alternatives in 2026: Burp Suite DAST and seven tools compared
Burp Suite Enterprise Edition is now Burp Suite DAST. Seven alternatives compared from vendor sources, with a choice table and a two-week bake-off plan.
Astra Security alternatives in 2026: nine options and how to choose
Astra Security alternatives compared from vendor sites: human-led PTaaS, AI pentesting, DAST in CI, attack surface tools and open source.
Intruder alternatives in 2026: nine options and how to choose
Intruder alternatives compared from vendor docs: infrastructure scanners, DAST, open source and exploit-confirmed testing, plus how to choose.
Cobalt alternatives in 2026: seven options and how to choose
Cobalt alternatives compared from vendor sites: human-led PTaaS, hybrid and AI-led testing, with a checklist to choose and trial them.
Synack alternatives in 2026: seven options and how to choose
Synack alternatives compared from vendor sites: crowd platforms, curated PTaaS, autonomous AI and proof-first testing, plus how to choose.
Pentera vs NodeZero: how do they compare, and what do both leave out?
Pentera vs NodeZero compared from vendor sources: internal, external and cloud scope, deployment, safety, plus where web-app and API testing fits.
Aikido vs Snyk in 2026: coverage compared and how to choose
Aikido vs Snyk in 2026: SAST, SCA, DAST, containers, IaC and AI pentesting per each vendor's docs, what neither replaces, and a four-week trial.
StackHawk alternatives: 9 options compared and how to choose
StackHawk alternatives compared from each vendor's own site: developer-first DAST, enterprise scanners, open source and white-box pentesting.
Detectify alternatives in 2026: 8 options compared by need
Detectify alternatives for 2026 from each vendor's own pages: Intruder, Invicti, Burp Suite DAST, StackHawk, Escape, ZAP, ProjectDiscovery and Cyberlop.
HackerOne vs Bugcrowd in 2026: bounty, pentest or automated testing?
HackerOne vs Bugcrowd from each vendor's own pages: bug bounty, pentest and disclosure compared, and when to choose a bounty, a pentest or automated testing.
Best API security testing tools in 2026: nine options and how to choose
Best API security testing tools in 2026, compared from vendor docs: DAST, open source, contract-first, runtime, plus a one-week bake-off.
Best PTaaS Platforms in 2026: 9 Compared on Evidence, Retesting and Reporting
Nine PTaaS platforms compared on scope, evidence, retesting and reporting, from vendors' own sites, with six criteria to choose by.
Best penetration testing companies in India (2026): nine providers and how to choose
Best penetration testing companies in India for 2026: nine providers from their own sites and the CERT-In list, with criteria and a scorecard.
Beagle Security alternatives: what to use instead, and how to choose
Beagle Security alternatives compared from vendor sources: pentest platforms, DAST, pipeline tools and free options, plus a trial plan.
Rapid7 InsightAppSec vs Qualys WAS vs Tenable Web App Scanning in 2026
InsightAppSec vs Qualys WAS vs Tenable Web App Scanning in 2026: login, APIs, CI/CD, deployment and retests per each vendor's docs, plus how to choose.
Veracode vs Checkmarx in 2026: what each covers and how to choose
Veracode vs Checkmarx compared from each vendor's own pages: SAST, DAST, SCA, hosting, AI fixes, plus a trial plan and what neither replaces.
Open source AI pentesting tools: what each does and where it stops
Open source AI pentesting tools compared from their own repos: PentestGPT, Strix, Shannon, Nuclei, ZAP and more, with limits and safe-use rules.
Best vulnerability scanner for startups in 2026: ten options and how to choose
Best vulnerability scanner for startups in 2026: nine tools compared from their own sites, a stage-by-stage stack, SOC 2 timing and a first-week plan.
Pentest platform for MSSP: how to choose one in 2026
Pentest platform for MSSP compared from each vendor's own pages: PlexTrac, AttackForge, Faraday, Dradis, SysReptor, Pentest-Tools.com, Astra and Cyberlop.
Tutorials
Using the platform, step by step
Getting started with Cyberlop: from sign-in to your first finding
Add a target, build a scan profile, run your first scan and read the findings, with the exact buttons and fields at each step.
Cyberlop dashboard overview: what each card means and what to act on
Every card on the Cyberlop dashboard explained: stat cards, severity bars, top vulnerable targets, remediation and recent scans, plus a five-minute routine.
Cyberlop key terms: targets, profiles, scans and issues
Plain definitions of targets, scan profiles, scans, issues, severity, confidence, triage and roles in Cyberlop.
White-box vs black-box scans: how to choose a scan type in Cyberlop
Choose between white-box and black-box scans in Cyberlop: what each needs, what each finds, and how to add logins for a grey-box style scan.
How to add a target in Cyberlop: the New target dialog, field by field
Add a target in Cyberlop: the New target dialog field by field, white-box vs black-box, repository URL, environment, and why targets cannot be edited.
Connect a repository to Cyberlop for white-box scans
Add the HTTPS repo URL and branch, choose a personal or organisation Git token, set allowed hosts and fix common clone problems.
Verify target ownership in Cyberlop: DNS TXT record or staff approval
Why black-box scans need ownership proof, the DNS TXT and staff approval routes, and what the Verified badge on the target page means.
How to manage targets in Cyberlop: list, export, change and delete
Manage targets in Cyberlop: the Targets list and detail page, JSON and CSV export, why targets are immutable, how to change one, and what delete removes.
How to create a scan profile in Cyberlop: Scope, Authentication, Reporting
Create a scan profile in Cyberlop: Scope, Authentication and Reporting fields, exploitation on or off, Preview YAML and Save, with a troubleshooting table.
Choose vulnerability classes in a Cyberlop scan profile
The ten vulnerability classes in a scan profile, what each covers, when to narrow or leave them all on, and how to filter results by class.
The exploitation phase: on or off, and safe in production
What Run exploitation phase does, what proof looks like, when to turn it off, and how to run it safely against production.
How to set focus and avoid rules on a scan profile
Use focus and avoid rules to scope a scan: the seven rule types, example values, production safety, and how to check coverage.
How to scan behind login in Cyberlop with authentication roles
Scan behind login in Cyberlop: add authentication roles, choose privilege levels, combine form, header and OAuth methods, and guide the scan with AI guidance.
How to set up form login authentication in Cyberlop
Set up form login for a scan: login URL, test credentials, TOTP secret, success condition and login flow steps, with fixes for logins that fail.
How to add header token authentication to a scan profile
Add an API key or bearer token to a Cyberlop scan profile: header name and value, safe test tokens, rotation, and how to confirm the scan got in.
OAuth client credentials in Cyberlop: scan APIs with a minted token
Add OAuth 2.0 client credentials to a Cyberlop scan profile: token URL, client ID and secret, scope, header prefix, Complete authentication, rotation and fixes.
Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction
Set minimum severity and confidence, report guidance, rules of engagement and PII redaction in a Cyberlop scan profile.
Application context in Cyberlop: fill the ten fields and use Auto Generate from Repo
Fill in the ten application context fields of a Cyberlop scan profile, use Auto Generate from Repo, and write context that improves findings.
How to edit a scan profile
Edit a Cyberlop scan profile: what you can change, why the target is fixed, how blank secret fields keep stored values, Clear, and Preview YAML.
How to run a pentest scan in Cyberlop, and what happens next
Where to start a scan, what it needs, the five phases, how to follow it and what to do when it fails or pauses.
The scan detail page: how to read a Cyberlop scan from Overview to Diff
Read a Cyberlop scan: the Overview, Findings, Sitemap and Diff tabs, Refresh, the report menu and what each field means.
Failed or cancelled scans: what to check and how to re-run
What Failed and Cancelled mean in Cyberlop, how to use partial findings, a troubleshooting checklist and how to re-run a scan.
How to use the Cyberlop scan sitemap
Read the Sitemap tab: discovered endpoints by host, methods, params, notes and role chips. Filter, export CSV and check scan coverage.
How to compare scans in Cyberlop with the Diff tab
Read the Diff tab: new, fixed and regressed findings against the previous completed scan, and how to prove a fix after a re-scan.
How to schedule security scans in Cyberlop
Create a schedule from a scan profile: frequency, start date and time, timezone anchor and the Enabled toggle, plus how to read each run.
How to search and filter vulnerability findings on the Issues page
Search and filter findings on the Cyberlop Issues page: severity, confidence, class and target filters, triage chips, the seven columns and a weekly routine.
How to read a finding in Cyberlop: Summary and Evidence
Read a finding in Cyberlop: the Summary fields, and the payload, request, response, reproduction steps and screenshot on the Evidence tab.
How to triage findings in Cyberlop: disposition, assignee and notes
Set a disposition, assign an owner, add notes and click Update status. A triage workflow for fixed, false positive and accepted risk findings.
How to verify a vulnerability fix with fixed and regressed issues
How Fixed and Regression states work across re-scans, how to verify a fix with the Diff tab, and what to do when an issue comes back.
Severity vs confidence in Cyberlop: how to read and prioritise findings
Six severities, three confidences and a proof status on every finding. Learn what they mean and how to prioritise fixes and filter reports in Cyberlop.
How to download PDF reports in Cyberlop: three modes, three places
Download a branded PDF from the scan page, Recent Scans or Targets. Choose Open issues only, Include fixed & accepted, or Fixed issues only.
How to export vulnerability findings to CSV or JSON
Where the Export JSON and Export CSV buttons are, which to choose, how to use the files in spreadsheets and trackers, and how to open them safely.
How to group scan profiles by tag and group in Cyberlop
Create tags, build groups of scan profiles by tag or selection, and scope what people and API tokens can reach in Cyberlop.
Cyberlop activity feed: what it records and how to use it for audits
Read the Cyberlop activity feed: sign-ins, scans, triage, roles and support sessions, who can see them, how to search and an audit checklist.
How to add security scanning to your CI/CD pipeline
Copy the generated pipeline YAML, set CYBERLOP_URL and CYBERLOP_API_TOKEN, and get findings in your build log on every merge without blocking builds.
Cyberlop API reference: authentication, permissions and the OpenAPI spec
Use the Cyberlop API: 78 endpoints in 15 groups, session or Bearer token auth, permissions per route, worked calls and the OpenAPI download.
Cyberlop API tokens and permissions: how to issue and limit them
What a Cyberlop API token is, how permission keys work, which keys common jobs need, and how to rotate, revoke and audit tokens with least privilege.
How to connect a cloud key vault to Cyberlop
Connect a cloud key vault to Cyberlop: fill in the service-principal form, use Verify and Save, set least-privilege access and rotate the client secret.
Cyberlop chat notifications: set up a webhook for finished scans
Connect an incoming webhook in Settings → Notifications, test it, learn what each message contains and how to protect and rotate the URL.
Cyberlop self-hosted scan agents: scan private apps from inside your network
Add a Cyberlop self-hosted scan agent, run the one-time command, read its statuses, pin a profile to it and revoke it. Outbound HTTPS only, no inbound ports.
Git access in Cyberlop: set a read-only token and allowed hosts
Set a read-only organisation Git token, choose allowed hosts, verify or clear it, and see how personal and organisation tokens take precedence.
AI provider settings: included allowance, your own credential and models
Use the included AI allowance or save your own credential, verify it and choose a model for each tier. Includes the rate-limit note.
Single sign-on: set up OIDC, the redirect URI and account binding
Set up OIDC single sign-on: issuer, client ID and secret, redirect URI, admin-bound subject, auto-created accounts, testing and fixes.
Two-factor authentication: require MFA for everyone who signs in
Require MFA for all users with a TOTP authenticator app, understand SSO and recovery codes, and avoid the common setup mistakes.
Account and organisation settings: notifications, retention, logo and plan
Set notification emails and personal tokens, then configure retention, schedule timezone and report logo, and read the Plan & usage page.
What we will write about
Five things worth writing down
Three of these have a post today. The rest are empty, and an empty category is better than a filler post with our name on it.
Findings and teardowns
The classes of bug we keep finding, taken apart: what the code did, what the server did, and why the two disagreed. Our own work and public research, never a customer's application without their written say-so.
Building Cyberlop
Decisions made in the open. What we shipped, what slipped, what we tore out after two weeks, and the trade-offs behind the platform as we build it.
The benchmark
Method, results and arguments about method. The first run publishes 3 November with the misses in it, and the second on 2 March with the two diffed.
For MSSPs
Running this for other people: white-label reports, the multi-client console landing 27 November, and the commercial shape of reselling testing you did not have to staff. The partner programme →
Playbooks
Practical things a security or engineering lead can use the same afternoon, whether or not they ever buy from us. How to read a finding, how to scope a pilot, what to ask a testing vendor.
Honesty, as a standing rule
We publish the misses, we report a slipped date the week it slips, and we do not invent numbers, customers or quotes to fill a post. What we have not proved yet →
Reading about it is not the same as running it.
Those three posts are the arguments we make most often. If one of them is the claim you are unsure about, we would rather demonstrate it than write a fourth post.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.