Launching before you’re “ready” is hard. But waiting for perfect means missing out on real feedback. On the Numorian blog, we explore the balance between polish and progress during Cheksuite’s soft launch: blog.numorian.com/flipping-the...

We just kicked off the soft-launch of Cheksuite — our SaaS web vulnerability scanner. We're onboarding early users now. API scanning and powerful AI features coming soon. Read more: blog.numorian.com/introducing-...

Bootstrapping a startup? Learn how we launched with near-zero spend using smart tools, massive credits, and Mercury’s perks program. Real strategies, real savings. Read the full guide: blog.numorian.com/bootstrappin...

When GCP went down, it revealed how deeply interconnected our infrastructure really is. What started as a single outage rippled through the web. We wrote about the lessons: designing for failure, and the myth of independence. blog.numorian.com/a-ripple-in-...

We are pleased to reveal what we've been hard at work building - Cheksuite, the evolution of web application security. blog.numorian.com/announcing-c...

Chain-of-thought (CoT) AI models, such as OpenAI's o3-mini or DeepSeek's R1 show that LLMs can move beyond the hilariously wrong results that are common with simpler models, and produce results that are more accurate and more useful than many would have thought possible.

Learn Pentesting: SSRF - As application architectures continue to become more complicated, SSRF keeps offering new and unexpected ways to compromise systems. Too easily missed, this is a vital part of any application pentest, and should always be carefully explored.

Learn Pentesting: Blind SQLi - Easy to miss, tricky to confirm, time consuming to exploit. This vulnerability is becoming less common (thankfully), but still pops up and has devastating impacts. Because it's easy to miss, it's one that should get special attention.

Simple is better. This applies to many things, and we recently shared our thoughts on how this applies to IT systems. The more complex systems become, the harder they are to understand and secure.

You should train your people to not click dangerous links, but you can't expect humans to be perfect. There's a reason that defense in depth has been seen as a key part of protecting systems for decades. Technology + training is key to getting this right.

AI is being used more and more, integrated into more processes, used for more tasks, and exposed to more data. But how does security and privacy fit? And regulations like CCPA and GDPR? We recently shared our thoughts on this, and why it's so critical to get this right.

AI offers powerful insights, but decisions based solely on data can lead to harmful outcomes. Embrace a data-informed approach for thoughtful, ethical decisions. Read more about balancing AI and human judgment.

We believe in constant learning, and sharing knowledge whenever possible; as part of that we've been working on a series of blog posts called "Learn Pentesting." These go over common vulnerabilities, and how to find them during a manual pentest.

YAWAST is coming back, as yawast-ng, back in active development and with new features on the way. I've always loved working on this project, really happy it's coming back to life.

numorian.com/posts/announ...

github.com/Numorian/yaw...

Hello Bluesky!