Insights
Notes from the transition.
AI is rewriting how systems get attacked, and how they get defended. Here is what we are seeing, what is getting better, and what you can do about it now.
Field notes · November 1, 2026
Your new AI chatbot probably has access to every customer's files
When companies bolt RAG search or AI agents onto an existing portal, the database permissions that protected the web pages rarely carry over to the AI.
Our method · October 30, 2026
Why we modify open-weight models instead of training on data or renting a chatbot
We edit open model weights directly and refine our testing logic by hand from human findings. No third-party consumer APIs, and zero training datasets.
The threat · October 27, 2026
AI doesn't hack like a person. Here's what changed.
Old automated attacks rattled the front door with known exploits. Modern AI agents sign in, read how your application works, and chain small flaws together for pennies.
Good news · October 22, 2026
The good news: AI is going to make software much harder to break into
The same capability that made automated attacks smarter is helping defenders close vulnerabilities faster than ever. The risk isn't forever—it's the transition window right now.
AI ready · October 15, 2026
What it means to be AI ready
Being AI ready isn't a badge you buy. It means your websites, portals, and AI features have been tested by models as capable as the ones attackers use—and the findings have been fixed and re-verified.
Field notes · October 8, 2026
What we actually find: permissions, old plugins, AI leaks, and files left in public
Real-world exposures are rarely movie-hacker zero-days. They are ordinary gaps in permissions, forgotten hosts, and unguarded AI features that can be fixed in an afternoon once someone proves they exist.
Good news · September 21, 2026
Why a 30-person company can finally get the testing a bank gets
Deep application security reviews used to cost $30,000+ because every route and role check had to be tested by hand. Offloading the patient legwork to specialized models changed the math.
Good news · September 10, 2026
We've been through shifts like this before
From plaintext HTTP to Let's Encrypt, and from wide-open S3 buckets to private-by-default cloud storage, every new wave of web risk followed the same arc: an exposed transition window, then tougher defaults.