Field notes

Sumrite research from expert-led tests.

Case studies, hardening guides and compliance explainers from Sumrite penetration testers. No scanner dumps.

Laptop showing colourful source code, representing API endpoints under security testing

API penetration testing checklist Sumrite's checklist, built on the OWASP API Top 10.

A practical API penetration testing checklist mapped to the OWASP API Security Top 10: what to test for each risk, how to scope an API test and what a good report shows.

By Niyaz Khan2 September 20265 min read

Comparison of a scoped penetration test and a goal-based red team operation

VAPT Guides

Red team vs penetration testing: which one do you need? Sumrite on differences, goals and cost drivers

A pentest finds weaknesses in a defined scope; a red team tests whether you detect a real attacker. Here is how to choose.

By Faisal Khan31 August 20261 min read

Downtown Dubai skyline at sunrise, representing businesses covered by the UAE's federal data protection law

Compliance

UAE PDPL compliance guide for businesses What the law asks and how Sumrite helps you prove it.

A practical guide to the UAE's federal data protection law: scope and free-zone carve-outs, controller duties, breaches, transfers and the security evidence to build.

By Nishant Sharma28 August 20264 min read

Circuit board with a glowing brain shape, representing security testing of AI and large language model applications

VAPT Guides

AI and LLM application security testing Sumrite's practical guide to the OWASP LLM Top 10.

Prompt injection, data leakage through RAG, agents with too much power. How to test an LLM application properly, risk by risk, using the OWASP LLM Top 10.

By Faisal Khan26 August 20266 min read

Sumrite PTaaS finding detail for broken access control in an orders API with request evidence, fix guidance and a Jira ticket

VAPT Guides

PTaaS platform features: what actually matters A buyer's guide to pentest platforms, from Sumrite

What to look for in a PTaaS platform: live verified findings, evidence and fix guidance, Jira and GitHub sync, per-finding retests and audit-ready reports.

By Faisal Khan26 August 20261 min read

UAE regulatory frameworks DIFC, ADGM, CBUAE and PDPL mapped to a VAPT report

Compliance

VAPT report for UAE: DIFC, ADGM, CBUAE and PDPL evidence what reviewers expect, from Sumrite

A guide to VAPT evidence for UAE buyers: DIFC, ADGM, CBUAE and the federal PDPL, and how to scope a test for each.

By Faisal Khan24 August 20261 min read

Card payment terminal held over a counter, representing systems in the PCI DSS cardholder data environment

Compliance

PCI DSS 4.0 penetration testing requirements Requirement 11.4, line by line, with Sumrite.

What PCI DSS 4.0.1 Requirement 11.4 asks for: methodology, annual internal and external tests, segmentation checks, retests and the evidence a QSA expects.

By Niyaz Khan20 August 20265 min read

Lines of HTML and script on a dark editor screen, representing inline scripts governed by a Content Security Policy

Security Hardening

CSP unsafe-inline and unsafe-eval risks Sumrite on how they quietly undo XSS protection.

A CSP with 'unsafe-inline' or 'unsafe-eval' looks like protection but leaves the door open. What each keyword permits, why it matters and how to replace it.

By Niyaz Khan18 August 20265 min read

ISO 27001 Annex A controls 8.8, 8.29 and 5.35 listed with the evidence a VAPT provides

Compliance

ISO 27001 VAPT audit: what you need to know, from Sumrite.

ISO 27001 never says 'penetration test', yet auditors expect one. The controls behind it, the evidence they check and how to scope your VAPT.

By Nishant Sharma13 August 20267 min read

Executive summary page of a Sumrite sample VAPT report showing overall risk and findings by severity

VAPT Guides

Sample VAPT report: what is inside, section by section How to read a Sumrite penetration test report

A sample VAPT report walked through section by section: what the executive summary, findings, severity ratings, remediation tracker and retest letter each tell you.

By Faisal Khan13 August 20263 min read

Illuminated euro sign sculpture at night, representing EU financial entities subject to DORA resilience testing

Compliance

DORA TLPT vs penetration testing Sumrite on what EU financial entities actually need.

Every DORA firm needs yearly resilience testing. Only some must run threat-led penetration testing every three years. What each involves and how to tell which applies.

By Niyaz Khan11 August 20265 min read

Side-by-side comparison of an automated vulnerability scan and an expert penetration test

VAPT Guides

VAPT vs vulnerability scan: what is the real difference? and when each is enough, from Sumrite

A scan lists known issues. VAPT proves which ones matter. See when a free scan is enough and when you need an expert.

By Faisal Khan6 August 20261 min read

Talk to a tester

Want us to look at your application?

Scoped quote within a day. Expert-led testing, verified findings, a fix-and-retest cycle and a report your auditors can use as evidence.

Get a quote Explore services