RESEARCH & WRITING
Notes from the team
What we learn breaking and defending things, written plainly. No gatekeeping, no fluff.
Which HTTP libraries actually fetch a gopher:// URL? An empirically-tested SSRF matrix
We fired a gopher:// URL at the HTTP client of ten languages, watching a real socket. Only the six libcurl-backed clients open it; Go, Java, Python requests, Node, Ruby, .NET and wget all refuse before a socket ever opens. gopher-over-SSRF is a libcurl story.
JCS signature verification: six of seven RFC 8785 libraries agree on the canonical form, one does not
We ran 432 JSON values through seven RFC 8785 JCS implementations in five languages. Six produce byte-identical canonical output; one Rust crate sorts object keys by code point, and a signature it makes fails to verify under the others in up to 10.2% of cases.
Deterministic CBOR is not deterministic across libraries
We ran the same 3,061 values through five CBOR libraries in canonical mode. 26.3% produced more than one distinct canonical encoding and 40% disagreed on validity, which is exactly how a COSE or CWT signature verifies on one stack and fails on another.
Certificate transparency post-quantum: 43% of static-CT logs already sign with ML-DSA-44
We fetched the public checkpoint from all 70 static-CT logs. 43% already carry a post-quantum ML-DSA-44 signature, but only 11 have any witness cosignature, just 6 distinct witnesses exist, and 0 of them are post-quantum.
DNSSEC post-quantum readiness: 0% of the top 30,000 domains
We read the DNSKEY and DS records of the top 30,000 domains. 11.7% are DNSSEC-signed, ECDSA P-256 dominates at 76.6%, 3.0% still sign with deprecated SHA-1, and exactly 0 of 3,500 use a post-quantum algorithm.
SMTP TLS downgrade: the 92% gap behind DMARC
We read the mail-transport DNS of 18,012 domains. 79.3% publish DMARC, but only 3.3% deploy MTA-STS and 3.6% DANE, so 92% of DMARC enforcers can still have their mail stripped to cleartext in transit.
Does FIPS 140-3 disable post-quantum TLS? It silently downgrades you
We put Go 1.24 and OpenSSL 3.5 into FIPS mode and read the TLS 1.3 handshakes on the wire. Go strips every post-quantum group and falls back to classical P-256; OpenSSL keeps the non-approved X25519MLKEM768 hybrid. Neither offers the FIPS-approved group by default.
Remote MCP server security: half of the registry is someone else's server
We pulled all 19,321 servers in the official MCP registry. 50.0% expose a remote endpoint your agent connects to, 30.5% ask for a credential, and they resolve to 7,420 third-party hosts.
Is p=none enough? Publishing DMARC is not the same as enforcing it
We resolved the email authentication of 300 top domains. 84.7% publish a DMARC record but only 67.3% enforce one, and just 4.7% deploy MTA-STS.
How many top domains restrict who can issue their certificates?
We read the public CAA records of the 1,000 busiest domains. Only 32.4% limit which authorities can issue their TLS certificates; the rest set none.
How often should you get a penetration test?
At least once every 12 months and after any significant change. What PCI DSS, SOC 2, and ISO 27001 actually require, and when annual is not enough.
How exposed are the top 1,000 domains to email spoofing?
We read the public email-authentication DNS of the 1,000 busiest domains. 41.5% publish no enforcing DMARC, so mail forging their name can reach inboxes.
Red team or penetration test: which do you need?
Two terms, two different jobs. The real difference in goal and scope, and an honest gate on which your company actually needs.
How to prepare for your first penetration test
A practical checklist so day one is not wasted: scope, environment, access, timing, and the documents to have ready.
Does SOC 2 require a penetration test?
The standard never names one, but your auditor expects it. What the AICPA criteria actually say, and what auditors accept.
Do I need a pentest for cyber insurance?
It depends on the carrier and your coverage. What applications really ask, and why honest answers matter more than the test.
How much does a penetration test cost in 2026?
Real market ranges from public pricing guides, what actually drives a quote, and where a $100 check fits. No sales math.
What can attackers actually see about your company?
Subdomains you forgot, services that should never have been public, leaked passwords, and mail records anyone can forge. In plain language.
Why every engagement starts with a signature
Authorization and scope are not paperwork. They are the line between a penetration test and a crime. Here is how we draw it, every time.
Check, scan, or full pentest?
Three very different services get sold under the word "pentest." A plain guide to telling them apart and picking the one you actually need.
What OSCP, OSEP, and CRTO actually prove
The alphabet soup on a security team's page, translated into what each certification really tells you about the work you will get.