Securing AI systems without overconfidence or fear – Part 2: Attack surfaces and the checkpoint flow

Document information Series Securing AI systems without overconfidence or fear Part 2 of 5 Title Attack surfaces and the checkpoint flow Date May 2026 Author Hussein Bahmad (NVISO) Reading time ~13 min Version 1.0 This post aligns with the OWASP Top 10 for LLM Applications 2025, the OWASP AI Security Verification Standard (AISVS), and MITRE … Continue reading Securing AI systems without overconfidence or fear – Part 2: Attack surfaces and the checkpoint flow →

Why the pentesting playbook doesn’t fit: belief, assumptions, and non-determinism

Document information Series Securing AI systems without overconfidence or fear Part 1 of 5 Title Why the pentesting playbook doesn’t fit: belief, assumptions, and non-determinism Date March 2026 Author Hussein Bahmad (NVISO) Reading time ~12 min Version 1.0 Series: Securing AI systems without overconfidence or fear Part 1/5: Why the pentesting playbook doesn’t fit: belief, … Continue reading Why the pentesting playbook doesn’t fit: belief, assumptions, and non-determinism →

Attack and Defense in OT: Enhancing Cyber Resilience in Industrial Systems with Red Team Operations

In today's rapidly evolving industrial landscape, securing Operational Technology (OT) is more critical than ever due to increased connectivity and sophisticated cyber threats. Throughout this blog post series, we will dive into the world of Operational Technology Security. This edition of the series focuses on how Red Team assessments can assist companies in identifying and … Continue reading Attack and Defense in OT: Enhancing Cyber Resilience in Industrial Systems with Red Team Operations →

What’s new for TIBER-EU?

A brief look at the updated TIBER-EU framework with DORA TLPT coming into play. In our previous post, we have discussed the “transition” from TIBER to TLPT (Threat-Led Penetration Testing), highlighting some differences between the previous TIBER specification and the requirements as indicated by DORA. This is mostly just a change in terminology. We concluded … Continue reading What’s new for TIBER-EU? →

Wake up and Smell the BitLocker Keys

Many enterprise laptops use BitLocker to provide full disk encryption (FDE) to protect sensitive data from exposure if the laptop were stolen. But how adequate is the default implementation of BitLocker to protect data at rest in this scenario? The security of all encryption relies on protection of the key material. A common assumption is … Continue reading Wake up and Smell the BitLocker Keys →

TLPT & ME: Everything you need to know about Threat-Led Penetration Testing (TLPT) in a TIBER world.

Introduction In our previous post, we published an analysis of current TIBER implementations ahead of DORA's TLPT requirements. To recap, this contained: An overview of existing TIBER implementations (situation mid-2024) A comparison of the respective guidance documents w.r.t. major building blocks, such as the generic threat landscape, purple teaming, leg-ups, scenario X Assurance that consistency … Continue reading TLPT & ME: Everything you need to know about Threat-Led Penetration Testing (TLPT) in a TIBER world. →