PenTestIT.com

Your source for Detection Engineering, Security Research and Adversary Simulation

You are here: Home / Archives for 2026

Archives for 2026

Detection Engineering

Essential Detection Engineering Metrics

This is a list of essential detection engineering metrics.

Posted: by
Updated:

You have prioritized your threat detection backlog, but now want to quantify the progress. Throughout my career leading multiple threat detection engineering teams, I have relied on well-defined metrics to measure outcomes, demonstrate program value, and drive continuous improvement. In this post, I outline the detection engineering metrics I consider most important, spanning Read more about Essential Detection Engineering Metrics

Detection Engineering

“Severity” or “Expected Severity” for Prioritization?

This post introduce the concept of "Expected Severity" for threat prioritization.

Posted: by 721 views
Updated:

In one of my last post - Prioritizing a Threat Detection Backlog, I talked about prioritizing your threat detection backlog. It is true when you run a program in an organization. However, when you consume security content from another organization, severity is often generalized. This is where, the concept of expected severity can help and I trust should be used more often. Let Read more about “Severity” or “Expected Severity” for Prioritization?

Vulnerability Management

Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority

This blog is my interpretation of the Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority.

Posted: by 1,169 views
Updated:

This Microsoft Patch Tuesday March 2026 release addressed 93 vulnerabilities across Windows, Office, SQL Server, .NET, and Azure. Interestingly, two CVEs were publicly disclosed pre‑patch CVE‑2026‑21262 (SQL Server EoP) and CVE‑2026‑26127 (.NET DoS). However, unlike last month, no March CVE is confirmed exploited in the wild as of today. What is unusual is the fact that six of Read more about Microsoft Patch Tuesday March 2026 Exploitability and Patching Priority

Offensive Security

List of Open Source C2 Post-Exploitation Frameworks

This is a list of open source C2 post-exploitation frameworks.

Posted: by 1,371 views
Updated:

Restoring this post with the help of the Wayback machine - This post has been lying in my drafts for more than a year with edits all over. But two days ago, it was announced that Powershell Empire would no longer be supported by it’s authors. Hence just like I curated a list of adversary emulation tools, I finalized this list of open source C2 post-exploitation Read more about List of Open Source C2 Post-Exploitation Frameworks

Adversary Emulation

List of Adversary Emulation Tools

This is a list of open source and commercial adversary emulation tools

Posted: by 1,316 views
Updated:

As I went through the logs on this blog, I saw that an old post from 2018 was still being requested for! Thanks to the internet gods, I was able to find a cached copy. Currently, this is a paste of the old adversary emulation post as is. But, I will update it in a few days time. Every once in a while, the security industry brings forth a new buzz word and introduces Read more about List of Adversary Emulation Tools

Detection Engineering

Prioritizing a Threat Detection Backlog

These are a few methods that you can use to prioritize a threat detection backlog

Posted: by 1,092 views
Updated:

Most security teams eventually hit the same problem - the list of “detections to build next” grows faster than the capacity to actually build, test, and maintain them. Inputs from red-team exercises, threat intelligence reports, new CVEs, leadership asks, compliance requirements, and plain hype can drive a perfect prioritization backlog haywire. Without a clear model for Read more about Prioritizing a Threat Detection Backlog