The Forefront Blog
Practical guidance on penetration testing, threat exposure and staying ahead of real-world attackers.
October 2026
Every Business Needs Cyber Security. The Question Is, How Much Is Enough?
Every business needs cyber security, but how much is enough? Cyber threats, AI and everyday software vulnerabilities are growing, while budgets are not. Here is how to get the right level of protection without building an expensive internal team.
Read article
July 2026
You Vibe Coded It. Brilliant. Now Who's Going to Break It?
AI has collapsed the distance between idea and working software, and we think that is genuinely great. But the model that wrote your code never wrote your threat model, here is what that costs, and how to keep shipping fast without getting breached.
Read article
June 2026
Continuous Vulnerability Assessment vs the Annual Pen Test
Your pen test was accurate for exactly one day. Everything you shipped since is untested. The case for watching the gaps between tests, without pretending it replaces the test itself.
Read article
June 2026
Closing the Detection Gap: Validating Your Defences with AETOS
You have a SIEM, an EDR and a SOC. The only question that matters is whether any of it would actually fire during a real attack, and “I think so” is not an answer you want to give after a breach.
Read article
June 2026
A Practical Guide to Cyber Essentials Plus
Cyber Essentials Plus is now the price of entry for a lot of tenders. Here is what the assessor actually does to your machines, where firms fail first time, and how to walk in already knowing you'll pass.
Read article
May 2026
Why We Sample Phishing Campaigns Instead of Spraying 5,000 Users
A bigger campaign isn't a better one. We explain how we apply the IASME Cyber Essentials Plus sampling pattern to phishing engagements, why 200 is the right cap, and how that translates to honest pricing.
Read article
April 2026
AEV vs CTEM: Why the Industry's Hottest Debate Is the Wrong One
Gartner coined both terms. They were never meant to compete. Here is what buyers are actually asking for, and how to position your exposure programme around it.
Read article
April 2026
Your EDR Will Never See This: The Identity Attack Hitting MSPs and SMBs in 2026
Device code phishing bypasses endpoint security entirely by operating in the cloud identity layer. We walk through the attack step-by-step, what it looks like in your logs, and the practical defences that actually work.
Read article
February 2026
Leveling Up With AI: Skills, Pipelines, and Subagents for Security Work
How AI went from "interesting toy" to force multiplier for building security tools. A practical guide using a real DLL hijacking pipeline.
Read article
December 2025
From ClickFix to MacSync
MacSync is a macOS infostealer that harvests passwords, browser and crypto wallet data, Keychain items, and sensitive files. Whilst investigating this sample, it was discovered that it manipulates legitimate applications such as Ledger and Trezor to capture additional user information.
Read article
December 2025
Festive Standdown: Attackers Don't Take Christmas Off
Skeleton crews, delayed responses, and distracted staff make the holiday period prime time for attacks. Here's what to watch for.
Read article
December 2025
NCSC CAF: Mapping Penetration Testing to the 14 Principles
The Cyber Assessment Framework has 14 principles across 4 objectives. Here's how penetration testing maps to each.
Read article
December 2025
Detecting Kerberoasting: From Attack to Alert
A complete walkthrough of the Kerberoasting attack chain, the artifacts it creates, and the detections your SOC needs.
Read article
November 2025
Running Your First Purple Team Exercise
A practical guide to planning and executing purple team exercises that actually improve your security.
Read article
November 2025
DORA Article 26: Threat-Led Penetration Testing Explained
What DORA's TLPT requirements actually mean for financial entities, and how they differ from standard penetration testing.
Read article
November 2025
CTEM vs Traditional Pentesting: What Actually Changes
Understanding where Continuous Threat Exposure Management fits, and where traditional pentesting still matters.
Read article
November 2025
CHECK, CREST, and CBEST: UK Security Testing Standards
A clear breakdown of the three main UK security testing standards and when each applies.
Read article
