We’re heading to @cactuscon.com 14! Bishop Fox is sponsoring again this year, with talks from Dan Petro and Nate Robb on EDR evasion and real-world CVE prioritization. And we’ll be around all weekend to talk tradecraft, research, and offsec! Feb 6-7 | Mesa, AZ

Happening tomorrow! Join @datadoghq.com’s State of Cloud Security livestream with Senior Security Consultant @alethe.bsky.social for an attacker-focused breakdown of what the cloud security data is really showing. Jan 27 | 12 p.m. ET

Cloud environments are so noisy. CloudFox helps surface the good stuff: real attack paths in AWS and GCP. Try it on GitHub: github.com/BishopFox/cl...

We're excited to see Senior Security Consultant @alethe.bsky.social joining @datadoghq.com later this month for a live discussion on their State of Cloud Security Report. January 27 @ 12 p.m. EST

Choosing a red team vendor is really about who delivers clarity when decisions matter.

If you’re doing an application pen test, it should actually help you understand risk. On Jan 21, Dan Petro walks through how app pen tests work in practice, common gaps, and how to get better results in modern, API-heavy environments. bishopfox.com/resources/ap...

Pen tests work best when security and engineering are on the same page. This free guide explains how application penetration testing fits into modern development, what good testing looks like, and how to use results to improve security over time: bishopfox.com/resources/ap...

And just like that… 2025 is a wrap. Check out our top research, virtual sessions, blogs, and new tools of the year! Special acknowledgements: @alethe.bsky.social, @br4inde4d.bsky.social, @noperator.bsky.social

Tool Spotlight: IAM Vulnerable IAM Vulnerable is an open source playground that spins up intentionally vulnerable IAM configs so you can practice finding and exploiting real privesc paths safely. Try it: github.com/BishopFox/ia... More info: bishopfox.com/tools/iam-vu...

AADAPT gives us a shared language for attacks on digital-asset systems. This post walks through how red teams can use AADAPT as a practical roadmap, starting with value flows and ending with real detection signals. bishopfox.com/blog/mitre-a...

Latest on #drThe Edge: Why a 17-Year-Old Built an AI to Expose #Deepfake Maps https://www.darkreading.com/threat-intelligence/why-17-year-old-built-ai-expose-deepfake-maps #cybersecurity #darkreading #thekidsareallright

In the latest episode of The Entropy Podcast, Senior Security Consultant @alethe.bsky.social joins Francis Gorman to talk social engineering, DEF CON, ethics, mentorship, and how AI is changing the way attackers (and defenders) think about people: www.buzzsprout.com/2445415

If you’re likely going to set up/fix everyone’s new gadgets this holiday season, you deserve something cool too. We just dropped a Hacker Holiday Gift Guide with gear, books, and tools hackers actually want, all sourced from our team and community. bishopfox.com/blog/hacker-...

Tool Spotlight: Unredacter Pixelation ≠ redaction. Unredacter proves it. Play with the tool → bishopfox.com/tools/unreda...

AI is shaking up cybersecurity, and if you’re still red teaming like it’s 2020… why? Attackers definitely aren’t. AI is making them faster and way more creative. Join Trevin Edgeworth tomorrow to hear how we’re evolving our Red Teaming to keep up: bishopfox.com/resources/re...

We’re LIVE! Sliver Workshop Part 3: Building Better Encoders is starting now. Join us to learn how Sliver handles traffic encoding and how to build custom WebAssembly-based encoders: bishopfox.com/resources/sl...

New guide out today: Fortifying Applications: A Security Guide to Penetration Testing. It explains what a modern application pen test should include, how to ask the right questions, and how to get real value from your engagement. Full guide here: bishopfox.com/resources/ap...

Happening tomorrow! Sliver Workshop: Building Better Encoders 2 p.m. ET / 7 p.m. GMT Join via Discord or our site. Tim Makram Ghatas will cover Sliver’s encoding defaults, WebAssembly, and how to design/test custom encoders.

We dug into the Arista NG Firewall CVEs and found the impact goes far beyond the initial advisory, including a viable XSS to RCE chain and a patch that doesn’t fully mitigate the underlying issues.

Tool Spotlight: GitGot Quickly scan GitHub for exposed secrets using flexible filtering and fuzzy matching. Built to make large search results easier to work through.

2026 is going to push security teams harder than any year before it. More AI. More connected systems. More attacker automation. Our leadership team breaks down the forces that will reshape pen testing, CISO priorities, hardware security, and Red Team specialization next year.

My team confirmed that recently disclosed Arista NGFW vulnerabilities are fully exploitable! RCE is possible with victim interaction. More details coming soon to our blog: bishopfox.com/blog

AI is changing attacks and expectations for security leaders. On Dec 11, Trevin Edgeworth discusses how Red Teaming helps validate resilience against AI-driven threats. 2 p.m. ET Save your seat: bishopfox.com/resources/re...

Our next Sliver Workshop lands Dec 9. This session covers building better encoders, how Sliver handles traffic encoding, and how to extend it with custom Wasm-based techniques. Hosted by Senior Security Consultant Tim Makram Ghatas.

Bishop Fox and acceligence are partnering to give organizations a more complete view of cyber risk, one that spans both strategic decisions and the realities of modern attacker techniques.

On Dec 11, Red Team Practice Director Trevin Edgeworth breaks down how modern Red Teaming helps leaders see real attack paths, validate resilience, and make sharper decisions in an AI-driven threat landscape. 2 p.m. ET / 7 p.m. GMT

Tool Spotlight: Broken Hill If you’re exploring LLM security or Red Teaming, Broken Hill is worth a look. It automates GCG-style jailbreak testing so you can safely probe model weaknesses without heavy hardware. Open-source here: github.com/BishopFox/Br...

We’re live at BugCon! Training kicks off today with Samanta, Axel, and Juan and we’ll be at the booth all conference long. If you’re in CDMX, come stop by. We’d love to meet you. ¡Bienvenidos a BugCon 2025! bishopfox.com/events/bugco...

🔴 LIVE NOW: Peeling Back the Plastic Nick Cerne is demoing how researchers uncover 0-days hidden inside everyday IoT devices from firmware to hardware to mobile apps. Jump in here ⬇️ bishopfox.com/resources/pe...

We’ll be at #BSidesATL Saturday, Nov 15 as a Silver Sponsor! Come say hi at the Bishop Fox booth, meet the team, and talk all things offensive security. KSU Center – Kennesaw, GA

Want to really understand LLM security? Our latest blog breaks down the best Capture the Flag challenges for testing and defending large language models. Full list: bishopfox.com/blog/ready-t...

Definitely worth a listen. Two great minds in cybersec!

Happening tomorrow at OWASP Global AppSec in DC: Senior Security Consultant Nick Cerne will present “Peeling Back the Plastic: Finding 0-Days in IoT Devices.” And join us Friday night at Flight Club for drinks, darts, and good times! Nov. 6-7 | Washington, D.C. RSVP: partiful.com/e/otaKEF0mqB...

New from Bishop Fox: Burp Variables, a Burp Suite extension that automates variable handling. Define once. Reuse everywhere. No more manual token edits! bishopfox.com/blog/burp-va...

Tomorrow @ 2 EDT: Demystifying 5G Security w/ Drew Jones. Real-world tactics for testing & defending 5G networks. Save your seat: bishopfox.com/resources/5g...

Working on DORA compliance? Bishop Fox’s FAQ guide breaks down Threat-Led Pen Testing from planning to reporting. bishopfox.com/resources/gu... #DORA #TLPT

A $20 smart device. A curious researcher. Bishop Fox’s Nick Cerne found some new vulnerabilities that could literally open your front door. Read his story → bishopfox.com/blog/how-a-2... #IoTSecurity

🚨 New Bishop Fox advisory: YoSmart YoLink Hub (v0382) found vulnerable. Attackers could: • Remotely control devices • Intercept traffic • Hijack sessions Details: bishopfox.com/blog/yosmart...

We’re live with cloud expert Mitchell Sperling talking CloudFox! Join here: bishopfox.com/resources/cl...

Cloud enumeration is messy. CloudFox makes it manageable. Join Senior Security Consultant Mitchell Sperling for a hands-on workshop: 📅 Oct 1 | 🕑 2 p.m. EDT / 7 p.m. BST Learn how to find real attack paths in cloud pen tests. Save your seat: bishopfox.com/resources/cl...

We’re proud to sponsor Hacker Halted 2025 + the Global CISO Forum (Oct 1–2, Atlanta). We have a limited number of VIP badges to share — if you’re interested in attending, reach out to our team. Details: www.linkedin.com/posts/ec-cou...

SecDSM October Meetup 🎃 📅 Thu, Oct 2 @ 6 PM 📍 Foundry Distillery, West Des Moines Costume contest, scavenger hunt, spooky CTF, trivia & prizes (yes, whiskey!). Bishop Fox is proud to sponsor. Details: bishopfox.com/events/secds...

CHOTINER: You believe AI alone will solve cybersecurity? EVANGELIST: Yes, it will eventually detect everything. CHOTINER: Including attacks run by other AI? EVANGELIST: Well… yes, AI learns. CHOTINER: So you’re building the attack and the defense simultaneously. EVANGELIST: Now wait a minute-

Think your OAuth tokens may be compromised? Here’s what AppOmni CTO Brian Soby says you should do first:

When your SaaS vendor gets breached, it can break your whole business. AppOmni’s CTO Brian Soby explains how a single compromise can ripple through disconnected tools, board reporting, and day-to-day ops. Full chat with Bishop Fox CISO Christie Terrill: bishopfox.com/resources/sa...

“There’s a war out there… and it’s not about bullets. It’s about who controls the information.” – Marty Bishop, Sneakers RIP Robert Redford. Your character inspired the name Bishop Fox and our mission to keep people safe, online and off. Always a Sneaker.

Red Teaming validates controls, trains defenders, and gets everyone from SOC to the board on the same page. bishopfox.com/blog/top-rea...

Senior Security Consultant Drew Jones dug into the 5G registration protocol and found that early connection messages aren’t encrypted, identifier privacy can break down, and devices still request null encryption: bishopfox.com/blog/demysti...

Red Teaming only works if you’re ready for it. This free Red Team Readiness Guide helps you align stakeholders, clarify goals, and avoid planning pitfalls. Get it here → bishopfox.com/resources/re...

Some say there’s a cybersecurity talent shortage. But ask the thousands of grads and self-taught hackers who can’t land an entry-level role and you’ll hear a different story. In her latest blog, @alethe.bsky.social breaks down the paradox: bishopfox.com/blog/talent-...