Behind the graph: The art of target selection for AI pentesting
Target selection has guided traditional pentesting for years, and it now has a second job: directing compute and token budgets to the attack surface assets that actually matter.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
41 matching stories — announcement, in Security Scanning — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Is AI pentesting as good as a human pentester?
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]
Agentic Commerce on Black Friday & Cyber Monday: What Retailers Need to Know
Key Takeaways AI traffic reaches retail sites in four forms: AI shopping agents, AI referrals, LLM crawlers, and unauthorized scrapers. Each needs a different response, The post Agentic Commerce on Black Friday & Cyber Monday: What Retailers Need to Know first appeared on CHEQ.
State of AI pentesting: adoption, trust, and the future of the pentest
We surveyed 500 security and engineering leaders on how often they pentest, how far AI pentesting adoption has come, and what they need to rely on it.
How to evaluate an AI pentesting tool
What to look for in an AI pentesting tool: 9 questions covering data handling, safety, auditor-ready reports, false positives, and retests.
Your site has a new audience. CHEQ Manage lets you see it.
Clear visibility into what AI traffic is visiting your site, and how often. Think about who visits your site on a normal day. Customers comparing The post Your site has a new audience. CHEQ Manage lets you see it. first appeared on CHEQ.
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri has described the malware as a "self-healing mesh" that's
The CAPTCHA Is Dead. Don’t Mourn It. It’s Time To Move On.
On September 7, an OpenAI engineer posted a screen recording of GPT-6 Astra playing “I’m Not a Robot,” a browser game built from 48 CAPTCHA-style The post The CAPTCHA Is Dead. Don’t Mourn It. It’s Time To Move On. first appeared on CHEQ.
ASM Has a Silent C, and It Stands for Change Management
Attack surface management has served the vulnerability management program for years, and it now has a second job, governing the asset sprawl that AI makes sprawlier by the day.
Emerging Threat: GeoServer Zero-Day SQL Injection via jsonArrayContains
An unauthenticated SQL injection in GeoServer's jsonArrayContains filter function lets attackers inject arbitrary SQL through public WMS and WFS endpoints, reaching remote code execution on privileged database hosts.