Research
Fine-Tuning vs RAG for Cybersecurity Models
Separate behavior training from retrieval context when evaluating a cyber model and its assessment workflow.
Oct 29, 2026 · 3 min read
FailSafe insights
Security research and insights
Incident reporting, security research, practical guides and product updates.
Recent articles
Features
CI/CD security review: untrusted changes and deployment authority
A CI/CD security review should examine where untrusted contributions or build inputs can interact with trusted credentials and deployment permissions. A passing test suite does not
Oct 29, 2026 · 3 min read
Features
Pentest Scope Changes: A Practical Change-Control Record
Handle new domains, user roles, integrations, and environment changes during a pentest with a written scope-change record.
Oct 29, 2026 · 3 min read
Features
MCP Consent Screens: Verify What the User Actually Approved
Review OAuth consent and sensitive MCP action approval without confusing a connected server with permission for every future operation.
Oct 29, 2026 · 3 min read
Features
Tool-Result Prompt Injection: Test the Data-to-Action Boundary
Assess whether untrusted search results, documents, and tool responses can change an agent’s authority using harmless test fixtures.
Oct 29, 2026 · 3 min read
Features
Multi-Tenant Pentest Planning: Evidence for Customer Isolation
Plan a bounded customer-isolation assessment with synthetic tenants, role relationships, state transitions, and explicit coverage limits.
Oct 29, 2026 · 3 min read
Features
Function-level authorization testing for administrative APIs
Function-level authorization testing asks whether a role can perform an operation reserved for another role. The test should follow a documented privilege model through backend ope
Oct 29, 2026 · 3 min read
Features
AI Agent Egress Controls: Test More Than a URL Allowlist
Review outbound destinations and data movement across browser, HTTP, email, and connector tools in an authorized agent workflow.
Oct 29, 2026 · 3 min read
Features
Azure pentest planning: authorization and resource boundaries
Azure pentest planning should name the owned resources and permitted activities before any assessment traffic begins. Written customer authorization and Microsoft's applicable rule
Oct 29, 2026 · 3 min read
Features
Pentest Delivery Acceptance: Check the Report Against the Agreement
Review scope, evidence, limitations, urgent findings, retest terms, and handoff completeness before accepting a penetration-testing delivery.
Oct 29, 2026 · 3 min read
Features
How Buyers Should Interpret AI Cyber Benchmark Results
Read agentic pentesting benchmark claims through task scope, version, denominator, attempts, grading, and real-environment limitations.
Oct 29, 2026 · 3 min read
Features
Webhook security testing: signatures, replay, and delivery state
Webhook security testing should distinguish authentic delivery from safe processing. A valid provider signature establishes one property; it does not by itself prove that an event
Oct 29, 2026 · 3 min read
Features
LLM Output Rendering: Test the Destination, Not Just the Text
Assess HTML, Markdown, links, exports, and downstream fields produced from model output using harmless rendering fixtures.
Oct 29, 2026 · 3 min read
Features
OAuth redirect assessment: validate the entire login round trip
An OAuth redirect assessment should examine the registered callback, the authorization response, and the application session created afterward. A callback that loads successfully i
Oct 29, 2026 · 3 min read
Features
MCP Tool Authorization: Test Access to the Actual Object
A practical plan for checking user and object permissions behind MCP tools, beyond successful login or read-only tool labels.
Oct 29, 2026 · 3 min read
Questions & answers
Frequently asked questions
How to navigate FailSafe's security research, analysis, and updates.
The FailSafe blog covers security research, exploit analysis, case studies, product updates, company news, and practical guidance for protecting critical systems.
Use the category filters on this page to browse research, features, case studies, hacks, FailSafe news, and product articles.
Yes. The research section includes analysis and findings produced by FailSafe's security team, alongside technical case studies and commentary on emerging threats.
Responsible disclosures and public upstream security contributions are listed in the FailSafe Disclosure Program at getfailsafe.com/disclosures.