Features
Build an MSSP Sovereign Pentesting Service with FailSafe
Design a partner-led offensive-validation service with customer boundaries, evidence, remediation ownership and deployment choices.
Oct 29, 2026 · 3 min read
FailSafe insights
Security research and insights
Incident reporting, security research, practical guides and product updates.
Recent articles
Features
GraphQL authorization testing: follow relationships and resolver context
GraphQL authorization testing should examine the data and operations exposed through resolvers, including nested relationships. A single API endpoint can contain many distinct perm
Oct 29, 2026 · 3 min read
Features
AWS IAM assessment: explain effective permissions before testing
An AWS IAM permission assessment should explain the authority of a tested identity across relevant policy layers. A role name or one attached policy is an incomplete description of
Oct 29, 2026 · 3 min read
Features
Business logic pentesting: define the invariant before testing
Business logic pentesting is most useful when a team can name the business rule that must remain true. Workflow outcomes, approval requirements, and entitlement decisions need appl
Oct 29, 2026 · 3 min read
Features
Agent Tool Retries: Prevent Duplicate Business Actions
Assess request identity, duplicate handling, approval reuse, and final-state reconciliation when an agent retries a consequential tool call.
Oct 29, 2026 · 3 min read
Features
How to Review a Redacted Pentest Sample Report
Evaluate a sample penetration test report for coverage, evidence, prioritization, remediation usefulness, and honest limitations.
Oct 29, 2026 · 3 min read
Features
Session revocation testing: what remains valid after access changes?
Session revocation testing should examine how logout, password recovery, role changes, and account removal affect active access. An interface that returns to a login screen does no
Oct 29, 2026 · 3 min read
Features
SSO and MFA in a Pentest: Prepare Access Without Weakening Controls
Prepare representative identity-provider and application access for an authorized assessment while documenting any test-specific differences.
Oct 29, 2026 · 3 min read
Features
MCP OAuth Discovery SSRF: A Safe Review Workflow
Assess outbound request controls around MCP authorization discovery using owner-controlled destinations and network-level evidence.
Oct 29, 2026 · 3 min read
Features
Agentic Pentesting for Banks: Keep Evidence and Inference Reviewable
Plan a banking application assessment around synthetic transactions, identity boundaries, evidence custody and private inference.
Oct 29, 2026 · 3 min read
Features
RAG Document Ingestion: Review Provenance and Parser Boundaries
Assess document acceptance, extraction, provenance, and quarantine before untrusted content reaches a retrieval index.
Oct 29, 2026 · 3 min read
Features
System Prompt Exposure: Separate Confidentiality from Authorization
Review what belongs in a prompt, what a disclosure would mean, and which permissions remain enforced if instructions become visible.
Oct 29, 2026 · 3 min read
Research
SWARM Finds Mythos Zero-Day Vulnerabilities
Anthropic recently proved that AI is superior to humans at vulnerability discovery. We explore the economics of their $20,000 Mythos scaffold, and how FailSafe SWARM replicated the
Apr 21, 2026 · 4 min read
Features
AI Security Testing POCs: Ask for Boundary Evidence
A procurement checklist for evaluating an AI security assessment through scope, synthetic scenarios, traces, limitations, and retest evidence.
Oct 29, 2026 · 3 min read
Research
Quantized Cyber Models: Validate the Deployment, Not the Model Name
Assess how quantization and serving choices affect security-task evidence, reliability and resource use.
Oct 29, 2026 · 3 min read
Questions & answers
Frequently asked questions
How to navigate FailSafe's security research, analysis, and updates.
The FailSafe blog covers security research, exploit analysis, case studies, product updates, company news, and practical guidance for protecting critical systems.
Use the category filters on this page to browse research, features, case studies, hacks, FailSafe news, and product articles.
Yes. The research section includes analysis and findings produced by FailSafe's security team, alongside technical case studies and commentary on emerging threats.
Responsible disclosures and public upstream security contributions are listed in the FailSafe Disclosure Program at getfailsafe.com/disclosures.