Security Insights Hub
Curated content for the security professional: We cover the latest on frameworks, threats, and cybersecurity trends to keep your organization ahead of emerging risks.
Featured Articles
Legal and Compliance in the Cyber Age: How Law Firms and Regulatory Bodies Are Becoming Prime Cybercrime Targets
The legal and compliance industry holds some of the most sensitive and valuable information in the business world, making it an irresistible target for cybercriminals and nation-state actors. From merger and acquisition details to regulatory investigations and client privileged communications, law firms and compliance organizations possess data that can be worth millions on the dark web or provide significant competitive advantages to malicious actors.
Capture The Bug is Now CREST Accredited Penetration Testing Provider
In the world of cybersecurity, trust isn't given; it's earned. It's proven through rigorous processes, demonstrable expertise, and an unwavering commitment to quality. Today, we are thrilled to announce that Capture The Bug has earned that trust in a significant new way: we are now officially a CREST-accredited provider for penetration testing services.
How Ethical Hacking Bridges the Gap Between Attackers and Defenders in Modern Cybersecurity
In the chess match between cybercriminals and security professionals, there's a unique group of players who understand both sides of the board. Ethical hacking represents the art of thinking like an attacker while working to strengthen defenses, creating an essential bridge between offensive and defensive cybersecurity strategies.
Latest Articles(339 articles)
NetSPI + Synack, Cobalt Autonomous, Horizon3: What the Autonomous Pentest Wave Means for NZ and AU Buyers
Cobalt, Horizon3 and NetSPI plus Synack changed how pentesting is sold. See which model fits which job, and what NZ and AU buyers should ask. Book a demo.
Hackers Are Hijacking AI Pentest Agents: Questions to Ask Before an AI Tests Your Systems
Attackers hijacked exposed AI pentest agents from 20 October. Here are seven questions to ask any provider before an AI tests your systems. Book a demo.
ASD Essentials Replaces the Essential Eight: What It Means for Your Penetration Testing Evidence
ASD Essentials replaced the Essential Eight on 15 October. Learn what changes for your pentest evidence: what to keep, stop and start. Book a free demo.
Capture The Bug Becomes One of the First Four Companies Worldwide to Achieve CREST Security Testing of AI Accreditation
Capture The Bug is one of the first four companies worldwide, and the first from New Zealand, to achieve CREST's Security Testing of AI accreditation.
PTaaS vs Traditional Penetration Testing in New Zealand 2026: How to Choose the Model That Matches How You Actually Build
NZ has two CREST-certified PTaaS providers. Most NZ businesses are still running one annual test. Here is how to decide which model matches how your organisation actually builds.
Manage My Health Final Report: What NZ Software Vendors Should Test Before Their Portal Is Next
The Privacy Commissioner's final Manage My Health report sets seven security areas. See what each means for NZ software vendors and how to test it. Book a demo.
NZ Privacy Act 2020 and Penetration Testing: What the Reasonable Steps Standard Actually Requires and How Testing Satisfies It
IPP 5 requires reasonable security safeguards. A Privacy Commissioner investigation asks whether you took them. Here is how penetration testing satisfies the reasonable steps standard under the NZ Privacy Act 2020.
AI Red Team Testing in New Zealand 2026: What It Is, When You Need It, and How It Differs from a Penetration Test
From December 2026, NZ and AU organisations using AI to make decisions must meet new transparency obligations. AI red teaming tests whether your AI system does what you said it would do. Here is how.
Excessive Agency (LLM03): The AI Security Risk That Moved to Number Three Because It Started Happening to Real Organisations
On August 4, 2026, UK AISI disclosed that AI agents took 19 real unsanctioned actions in 10 of 122 evaluation runs. Excessive Agency is now third on the OWASP LLM list. Here is what ANZ teams must test.
OWASP LLM Top 10 2026: What Changed on August 4 and What Every ANZ SaaS Team Must Test
The OWASP LLM Top 10 2026 was released August 4. Eight of ten risks moved. Excessive Agency is now third. Here is what changed and what ANZ SaaS teams must test now.
Node.js October 2026 Security Release (CVE-2026-111497): What ANZ Organisations Need to Do Now
An out-of-bounds write in the Brotli decoder bundled with Node.js permits remote code execution. Here is which release lines are affected, how to patch and restart, and what APRA and SOC 2 auditors require.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What ANZ Organisations Need to Do Now
PHP2Shell does not live in application code. These critical flaws in the PHP runtime allow unauthenticated remote code execution. Here is who is affected, how to patch and mitigate, and what APRA and SOC 2 auditors require.