Research

Security research from the front lines

Our consultants publish advisories, CVE research, threat intelligence, and detection content — coordinated with vendors and shared with the defensive community.

CVE ResearchCVSS 9.8

CVE-2024-41312: Java Deserialization Chain in Enterprise BPM Suite

A gadget chain in a popular business-process-management suite allowed unauthenticated remote code execution via a crafted serialized object sent to a REST endpoint. We worked with the vendor under coordinated disclosure and release a full technical write-up with detection guidance.

Mara Okonkwo May 14, 2025

AdvisoryCVSS 7.5

Advisory: Spring Cloud Gateway Route Predicate Bypass

A misconfigured route predicate allowed an attacker to reach an internal management surface by abusing path normalization. This advisory documents the vulnerable pattern, exploitation, and a server-side mitigation applied in version 3.2.4.

Daniel Reyes May 2, 2025

Threat Intelligence

Threat Intelligence Report: Q1 2025 Ransomware Landscape

Our analysis of 412 publicly disclosed incidents in Q1 2025 shows a continued shift toward data-extortion without encryption, the rise of affiliate consolidation, and a measurable increase in initial-access brokers selling VPN credentials.

Priya Nair Apr 18, 2025

Detection Engineering

Detection Engineering: Building Reliable Lateral-Movement Detections

A practical guide to authoring Sigma rules that survive telemetry changes. We cover attack-to-detection mapping, the ATT&CK technique selection process, and how to measure detection precision with controlled false-positive budgets.

Hugo Lindqvist Mar 29, 2025

Blue Team

Blue Team Insights: Isolation vs Containment During Active Intrusions

Choosing between host isolation and network containment during an active intrusion can change the outcome. We break down the decision framework, the telemetry you need beforehand, and the pitfalls we see during real engagements.

Sofia Marchetti Mar 11, 2025

Responsible DisclosureCVSS 8.1

Responsible Disclosure: XML Signature Wrapping in a Cloud IDP

During a customer engagement we identified an XML signature-wrapping flaw in a cloud identity provider that allowed authentication as an arbitrary user. Coordinated disclosure led to a patched release within 21 days; this report documents the technique and detection.

Mara Okonkwo Feb 20, 2025

Whitepaper

Whitepaper: A Maturity Model for Continuous Penetration Testing

Point-in-time testing leaves gaps between assessments. This whitepaper introduces a four-level maturity model for continuous penetration testing, with concrete controls and metrics for each stage of the journey.

CipherTest Research Jan 30, 2025

CVE ResearchCVSS 8.6

CVE-2024-4571: Kubernetes Service Account Token Abuse in Multi-Tenant Clusters

A default RBAC configuration in a managed Kubernetes distribution allowed tenant workloads to read cluster-wide service-account tokens. This write-up covers discovery, exploitation, and the network-policy and RBAC controls that prevent abuse.

Daniel Reyes Jan 12, 2025

Ready when you are

Find your vulnerabilities
before adversaries do

Request an assessment and a consultant will respond within one business day with a tailored scope and fixed-price quote.

Request Assessment

View Case Studies