Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Your vulnerability report is sorted by severity. The adversary looking at the same environment is sorted by path. That mismatch is the whole problem. Open any scanner output, and you get a tidy hierarchy: criticals at the top, then highs, then a long tail of mediums and lows that most teams will never touch. To the person who wrote the ticket, that tail is noise. To someone who thinks in chains, it’s a roadmap. A page of “lows” is not a page of things you can ignore.

Somewhere in your vendor list, right now, there is a door you have never checked. You didn’t build it, you don’t hold the key, and yet if someone walks through it, the breach notification goes out on your letterhead. The numbers too aren’t subtle. Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches now involve a third party, up from 30% just a year earlier, the sharpest rise the report has ever recorded. Your vendors are your attack surface now.

This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.

Some of the most dangerous vulnerabilities in modern web apps are the default features left switched on where they were never meant to be reachable. The first entry in our Findings from the AP series looks at an exposed actuator endpoint. On paper, this finding started the same way most do: an HTTP endpoint returned a 200. Nothing about that response looks unusual by itself. It’s the kind of line that gets logged, categorized, and moved past in most automated scans.

For years, our security team has run pentests against business-critical applications across industries, and one pattern stands out. The vulnerabilities that are the most difficult to remediate are business logic vulnerabilities: IDOR, broken access control, privilege escalation, and multi-step workflow abuse. These are the kind of vulnerabilities pentest experts find by noticing a broken assumption behind one API call and chasing it until the full exploit path becomes clear.