Asteros Blog
Don’t Mistake Process for Competence in Penetration Testing
On a recent call, a prospect asked us, almost apologetically,“Umm… if we have a question about something in the pentest report, can we…
A CTO’s Guide to HITRUST Penetration Testing Requirements
If you’re a technical leader at an organization that handles sensitive health information (ePHI), the phrase “HITRUST certification” likely brings a mix of…
Will a Pentest Get Us Through SOC 2 CC7.1? A Guide for Engineering Leaders
Preparing for a SOC 2 audit can feel like navigating a maze, especially when your team is already sprinting through development cycles. For…
How Long Should a Penetration Test Take?
This week, I told a prospect that our penetration testing process takes about ten times longer than what another firm had quoted him….
Raxis vs. Asteros: What Changes When a Firm Gets Bigger
If someone recommended Raxis to you, that’s not a bad recommendation. They’re Atlanta-based, their testers hold real credentials, their reviews on Clutch are…
Penetration Testing is Stuck in 2010. Here’s How to Move On.
Today I stumbled across a companion blog post for a talk from BSIDES Atlanta 2010. A talk I was actually in the audience…
What Terence Tao’s Red Team Analogy Gets Right About Security
Terence Tao, often called the greatest living mathematician, recently wrote about the nature of red and blue teams — builders and breakers. Their…
How Pentest Vendors Hide Bad Work Behind Process
Most companies think buying a penetration test means getting real security insights. But too often, all you get is a PDF and a…
Auditors and CTOs Call Out Fake Pentests
Many SOC 2 “penetration tests” aren’t actually penetration tests — and real auditors, CISOs, and engineers are calling it out. In this video,…
Don’t Rewrite Your SOC 2 Controls — Get an Emergency Pentest and Finish Strong
So you’re halfway through your SOC 2 audit, and someone just asked, “Wait, where’s the penetration test report?” Panic sets in. Maybe you…