Blog
Stay ahead with news, opinion and research from the Swarm.
The call nobody talks about
The attack call is the one that gets written up in the report. But in James Sheppard's experience, it's rarely the most important call he makes.
DORA Threat-Led Penetration Testing: What article 26 actually requires
Annual penetration testing does not satisfy DORA's testing mandate. Here's what Article 26 actually requires, who it applies to, and what a real TLPT exercise looks like in practice.
Deloitte ranks CovertSwarm among EMEA’s 500 fastest-growing tech companies.
Based on verified revenue growth of 595.89% over three years. Here's what the number means and why the model behind it was built this way from the start.
AI guardrails will always fail. NIST just proved it mathematically.
NIST scientist Apostol Vassilev has published a mathematical proof that no finite set of AI guardrails is universally robust against adversarial prompts. Not as a risk assessment. As a proof. Here's what that means for every organization that has signed off on an AI governance policy and considered the work done.
How RAID found unauthenticated customer data in a retail GraphQL API
CovertSwarm's web testing agent identified a critical broken access control vulnerability in a retail subscription platform's GraphQL middleware. The platform enforced authentication on its auto-generated queries, but every custom action handler bypassed the permission layer entirely, returning customer PII, subscription data, and health assessments to unauthenticated requests. This is a step-by-step breakdown of how RAID found it in under two minutes.
Your attacker knows when your last pen test was
Annual penetration testing doesn't just fail to keep pace with your attack surface. It operates on a calendar your adversaries can read. CovertSwarm COO Luke Potter on the reconnaissance signals that make your testing rhythm visible, and the logic that keeps security leaders locked into a model they know is broken.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
CovertSwarm has been named a Sample Vendor for Red Teaming as a Service in the Gartner Hype Cycle for Security Operations, 2026.
Claude Fable 5: what we know so far
Fable is the first publicly accessible version of Anthropic's Mythos-class model, the tier they initially decided was too capable to release at all. What does it tell us about what's next?
CovertSwarm is a founding signatory of the CREST AI Charter
CovertSwarm has become a founding signatory of the CREST AI Charter, endorsing nine principles for responsible AI use in cybersecurity.
Your AI coding tools are an attack surface.
RAID Files | Episode 02 Hosted by Dominika Pietrzak, RAID Every major AI coding tool, Claude Code, Cursor, Codex, Copilot, and Antigravity, has had at least one serious disclosure in the last three months. Some have had five or six.…
Sunday Times Best Places to Work. Three Years Running.
We attack businesses for a living. So we hold ourselves to the same standard internally. Here's what 100% participation and three consecutive years in the Sunday Times Best Places to Work really tells us.
DORA is not GDPR. Stop treating it like it is.
Most firms are treating DORA like GDPR: get a consultant, document the framework, move on. That worked for data privacy. It won't work for a regulation built around one premise: that financial entities will be attacked, and regulators want proof the system won't collapse when they are. Here's what DORA actually requires, where enforcement stands in 2026, and why compliance and resilience are not the same thing.
Frontier AI models are exciting.
CovertSwarm COO Luke Potter on why frontier AI is genuinely exciting, why most of the conversation is asking the wrong questions, and what it means for how we attack.
AI Sharpens the Question. It Doesn’t Change the Answer.
The cyber security industry has spent decades selling findings instead of answers. AI tools like Mythos make the problem faster and louder. Here's why the only thing that changes your risk posture is a real adversary, applied constantly, across every surface.
Constant Cyber Attack: What People Keep Getting Wrong
There are a lot of terms floating around offensive security right now. COST. CTEM. Exposure validation. Some of it is useful. Most of it is new wrapping paper on old delivery. This is what continuous offensive security testing actually needs to look like.
When “Just Logging In” Isn’t Just Logging In: A look at xrdp and CVE-2026-33145
A quiet finding with real-world impact. CVE-2026-33145 shows how xrdp's AlternateShell feature, enabled by default, passes client-supplied input directly into a shell, turning an RDP login into a clean, automatable command execution primitive.
AI & the adversary: what’s actually happening in 2026
RAID Files | Episode 01 Hosted by Dominika Pietrzak, RAID Every AI lab, EDR vendor, and threat intel team had something to say about adversarial AI this year. That’s a lot to read through. And honestly, figuring out what’s actual…
Mythos found a $20,000 bug. It won’t tell you who’s already inside.
Anthropic's Mythos has dominated the security conversation this week, but the debate about whether it's overhyped is the wrong argument. The real question is simpler and more uncomfortable: if an attacker had execution inside your environment right now, would you know?
CovertSwarm launches RAID: Our red team AI division
CovertSwarm COO Luke Potter announces RAID, our Red Team AI Division, and why real adversaries made it non-negotiable.
What kills new CISOs in their first 90 days – it’s not attackers.
The pen test report. The risk register. The green dashboard. They feel like facts. They're not. They're a record of someone else's decisions, at a point in time that's already passed. And in your first 90 days as CISO, they'll shape everything you do, if you let them.
CVE-2026-33727 – When “Low Privilege” Isn’t Low Enough: A Pi-hole LPE Story
Pi-hole's pihole user is low-privileged. It's configured with nologin. It looks contained. It isn't. Here's how a writable file and a trusting root process combine into a clean privilege escalation path.
Proof of Human solves the bot problem. It doesn’t solve the people problem.
World ID can prove a real human is behind an account. It can't prove that human hasn't already been phished, vished, or bribed. The biggest breaches of the past three years didn't fake humanity, they exploited it.
Too many rules, no real test: Untangling US Cyber Disclosure
The US has no single federal data breach notification law, just a growing patchwork of SEC rules, HIPAA, state obligations, and incoming CIRCIA requirements. Most organizations have the policies. Very few have tested whether the right people can apply them under pressure.
Project Glasswing is impressive. But what about the rest?
Anthropic's Project Glasswing is a serious step forward for technical security. But it covers one third of the attack surface. Here's what it leaves out, and why that matters.