Articles by phewadm

On 24 June 2026, OWASP released version 1.0 of the Artificial Intelligence Security Verification Standard, AISVS for short, and for those of us who test web applications (and increasingly the AI features bolted onto them) this is the standard we have been waiting for. Until recently, testing an AI-enabled feature meant improvising. Testers could borrow adjacent controls from the OWASP Application Security Verification Standard (ASVS), lean on the OWASP Top 10 for LLM Applications for a sense of the risk landscape, and draw techniques and methodology from the AI Testing Guide that OWASP published in late 2025. But the rest

If the Kaseya attack was a “supply-chain attack” in terms of the industry accepted definition then it is a stretch of that definition. The distinction is important, because software supply-chain compromises are harder for customers of software solutions to detect using usual defensive measures, and generally involve exploitation techniques that fall outside the scope of web application penetration testing standards. So there is a feeling that essentially no blame rests with the software customer, and perhaps reduced blame rests with the software vendor. In this post we explore the implications for Kaseya of mis-categorising this attack as a supply-chain attack.

What’s New? Cert NZ has released its first quarterly report for 2021. The Cert NZ reports provide an interesting snapshot of recent cyber security incidents reported by both individuals and organisations in New Zealand. The latest report shows that a total of 1,431 incident reports were made to CERT NZ in the first quarter of 2021, involving losses of almost $3 million. Notable Increases Reports of ‘unauthorised access’ increased significantly this quarter. Unauthorised access involves an attacker gaining access to an account without your knowledge. Often this happens because of weak passwords, or login credentials that have been leaked in

Online Security Online apps and tools have become an integral part of how we live and work. If you own or run one of these systems, you will be aware of the constant threat of a cyberattack, and the risks this poses to your business. If you use cloud services you should also be aware of the assumptions you are making about the security of those services, or have a basis for trusting the security assertions the vendor is making. Regular, pre-emptive penetration testing (or “pen-testing”) can mitigate these risks, provide knowledge and confidence, and improve the security and privacy

As you might expect, the bad guys are trying to use the global Covid-19 pandemic for malicious purposes.  The hunger for information, plus the disruption from half the world going into lock-down, perhaps combined with increased receptiveness to community support, all make this a pandemic rich and morally decrepit online hunting ground. The purpose of this post is not to add fear or reduce receptiveness to (online) community support.  But we do think it is important to know what sorts of things are going on, and to be on the look-out for them, particularly in this early period where everything