Resources
Articles from the IntruForce team on external attack surfaces, exposed data and practical remediation.
An infostealer steals data from an infected device — saved passwords, the session cookies that keep a person signed in, payment details — sometimes on a computer the company does not manage, and the result ends up in logs that others buy and reuse. How it happens, what it gives an attacker and what reduces the damage.
Read the article →What a hands-on test of a web application covers that a scanner alone cannot judge — access control, business logic, sessions and the APIs behind the screens — and how to scope one.
Read the article →What a penetration test is, which types exist, how to scope one, and what the report you receive at the end should contain. A guide for the person who commissions the test.
Read the article →A vulnerability scan checks your systems for known weaknesses; a penetration test checks whether those weaknesses can be exploited within an agreed scope. What each one answers, where each one stops, and how to tell which one you need.
Read the article →CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities catalog: an authentication bypass in the ownCloud WebDAV API involving pre-signed URLs. Here is how to check whether your own perimeter exposes an affected instance, and where the patching chain usually breaks.
Read the article →CVE-2026-59310 in VMware vCenter Server entered the CISA KEV catalog on 18 August 2026. This article separates two questions that often get merged — whether the defect is present, and whether the management interface is reachable from outside — and shows how to check the second one.
Read the article →CVE-2024-21762 has been in the CISA KEV catalog as actively exploited since February 2024. The vendor advisory could not be read during this research, so this note keeps strictly to what the primary records state — including why the usual “RCE via SSL-VPN” phrasing stays unconfirmed.
Read the article →In February 2025 Palo Alto Networks reported observed attempts to chain CVE-2025-0108, CVE-2025-0111 and CVE-2024-9474 against PAN-OS devices whose web management interface was reachable from untrusted networks. What decides exposure is the release train in use and where the management profile is bound.
Read the article →CVE-2026-60004 is in the CISA KEV catalog and Gitea has published an advisory. The external check is concrete: find Gitea instances that answer from the internet, establish their actual versions, and compare them with the affected ranges.
Read the article →The scope listed three domains and two IP addresses. Two hours in, that list no longer matched what was reachable from the internet. How an external test reconciles the declared perimeter with the real one — and where the tester's authority ends.
Read the article →A penetration test describes the perimeter as it was on the day of the test, while domains, IP addresses and services keep appearing between audits. What continuous observation of the external perimeter covers, and what only expert-led testing can find.
Read the article →Two vulnerabilities, one maintenance window. NIS2 does not say that an exploited vulnerability is fixed first — it asks you to connect the remediation decision to the risk to your own services, and to be able to show that reasoning.
Read the article →DORA testing gives an accurate picture on the date it was run; the external perimeter keeps changing after that date. What each control shows, where they overlap, and what neither of them decides.
Read the article →Cisco confirmed exploitation of the CVE-2023-20198 and CVE-2023-20273 chain in the IOS XE Web UI. The check starts with two questions: where the Web UI is enabled, and where it is reachable from outside — with the commands, versions and indicators to record for each device.
Read the article →CVE-2024-12356 is listed in the CISA KEV catalog, and BeyondTrust fixed its own cloud instances. For on-premise Privileged Remote Access and Remote Support, the decision has to be made instance by instance: hosting model, version, BT24-10 state and external reachability.
Read the article →Two Ivanti vulnerabilities that looked manageable on their own formed a working chain from the internet to command execution on the VPN gateway. A walkthrough of the chain, and of the points where it could have been broken.
Read the article →An authentication bypass in self-hosted ConnectWise ScreenConnect gave administrative control of a central RMM component. The chain, its limits, and the checks that could have caught it earlier.
Read the article →A new public host or cloud endpoint can appear between two scheduled inventories. What DORA asks financial entities to do about it, and where external perimeter monitoring stops and internal process begins.
Read the article →NIS2 leaves 24 hours for the early warning and 72 for the incident notification with an initial assessment of severity and impact. External exposure context collected in advance supplies facts for that assessment — and there are questions it does not answer.
Read the article →Your first step
Share your company website and a work email. We'll send your request to the IntruForce team. Tell us if you want to discuss a specific assessment instead.