CovertSwarm
About CovertSwarm
If you release code, hire people, open new premises or change your board more often than you attack yourself, you are not keeping pace with your own risk. CovertSwarm was founded in 2020 on that argument, frustrated that organizations relied on occasional penetration tests, thick reports and long gaps in between.
The Swarm runs realistic attacks across digital, physical, and social environments, then shows how weaknesses chain into paths an attacker could use against the business.
What we write about
- Continuous offensive security testing: Why occasional testing can’t keep pace with how often your organization changes.
- Emerging threats: New attack techniques and what they could let an attacker do to your organization.
- Offensive AI and AI security: Prompt injection, multi-agent risk and how attackers can turn AI and agentic systems against the organizations running them.
- Red teaming and adversary simulation: Chaining weaknesses into the attack paths a real adversary would follow.
- Regulatory threat-led testing: CBEST, STAR-FS and threat-led testing, from a team with CREST accreditation for both.
- Physical security and social engineering: Getting into buildings and past staff, and what that access exposes.
- Vulnerability research: Flaws in software and systems, and what an attacker could do with each one.
Latest posts
Handala & MuddyWater: MDM Weaponization at Enterprise Scale
On 11 March 2026, an Iranian two-team operation destroyed 200,000 enterprise devices at Stryker without deploying a single piece of malware. One compromised Global Administrator account. One MDM console. Five hours. Swarm Brief 2602 maps the TTPs behind the Handala and MuddyWater operation and the scenario CovertSwarm would run against your environment.
Swarm Intelligence: Stryker’s Intune wipe proves your BCDR plan has a single point of failure
No malware. No ransomware. One compromised Global Admin account and the management console your IT team used this morning. The Stryker incident proves that when the management plane becomes the weapon, your BCDR plan may already have a single point of failure.
Dynamic Attack Surfaces: The Professional Sports Problem
Professional sports organizations face cybersecurity challenges that don't fit traditional frameworks. With seasonal spikes, constant third-party integrations, and workforce volatility, annual pen tests capture one snapshot while attackers exploit the gaps between assessments. Recent breaches prove why continuous offensive security is essential for dynamic environments.
Jayson E Street Joins CovertSwarm
The man who accidentally robbed the wrong bank in Beirut is now part of the Swarm. Jayson E Street joins as Swarm Fellow to help us prove continuous offensive security is the only honest answer to how adversaries operate.
What Moltbook reveals about AI agent security
The Moltbook launch exposed a critical gap: organizations deploying AI agents faster than they can secure them. Research shows 22% of enterprises currently host unauthorised AI agent deployments, with most operating undetected and holding privileged access to corporate resources, creating a new attack vector that bypasses traditional security controls.
When a former UK Government cyber operations chief says AI is “limitless” in Offensive Security, we should pay attention
Jim Clover says AI has made offensive cyber "limitless." Attackers are using it now. The horse has already bolted. And if your red team isn't keeping pace, you're not testing against real threats.
Humans In The Loop: The Non-Negotiable In Offensive Security
AI and automation have transformed offensive security, but not replaced human ingenuity. Luke Potter explains why real attackers, and real defenders, still need humans in the loop.
CovertSwarm welcomes Jim Jordan as Head of Sales for the U.S. Division
Jim Jordan's leadership and experience in driving growth and client engagement strengthen our mission to deliver constant offensive testing across North America.
CovertSwarm Welcomes James Smith as Hive Leader, Expanding Operational Technology Security Expertise
James Smith joins CovertSwarm as Hive Leader, strengthening our Operational Technology (OT) offensive security expertise CovertSwarm proudly welcomes James Smith as a Hive Leader in the UK, expanding our offensive capabilities into Operational Technology (OT). His appointment strengthens our ability…
Weaponized patience: the strategic implications of the F5 breach
The F5 breach reveals the growing danger of shared infrastructure attacks. As adversaries learn faster than defenders, the only path to resilience is continuous, adaptive testing. This is not about blame, it’s about evolution.
Everyone has a plan until they get punched in the face: reflections on the NCSC 2025 annual review
The NCSC Annual Review 2025 delivers a reality check. Highly significant cyber incidents have increased by 50 percent year over year. It's time to act.
Part 3: CBEST Series – The Future of Threat-Led Penetration Testing
Regulated testing like CBEST is pivotal, but as threats shift, organizations must adopt more strategic, agile threat-led penetration testing. Discover what’s next.
Prime Day Scams – How Attackers Exploit Trust and Urgency
Every Prime Day, fake delivery texts flood inboxes, exploiting shoppers’ urgency and trust. We explain how these scams work and what both consumers and security teams can do about them.
Airport Chaos Shows How Fragile Our Infrastructure Really Is
Recent airport chaos revealed how fragile global infrastructure really is. A basic ransomware attack disrupted shared systems, grounding flights worldwide. The lesson is clear: outdated technology and rushed recovery leave industries exposed.
Offensive Security Is No Longer Optional
Gartner’s 2025 research validates what we’ve long believed: to stay ahead of attackers, organizations must embrace continuous, proactive offensive security.
Cobalt Strike External C2 Passthrough Guide
Cobalt Strike’s passthrough mode reshapes how red teams use External C2. By taking control of shellcode staging and custom channels, operators can bypass static detections and build covert pipelines that defenders are not ready for.
Part 2: CBEST Series – Operational Resilience
CBEST threat-led testing proves whether your organization can withstand real-world attacks, uncovering hidden weaknesses and driving true operational resilience.
Remote Work Security Gaps Still Driving UK Breaches
Despite years of adaptation, organizations are still being breached through remote access blind spots.
Part 1: CBEST Series – Beyond the Checklist
Explore how threat-led penetration testing helps financial institutions go beyond traditional checks to strengthen resilience and meet regulatory expectations like CBEST, STAR-FS and DORA.
Billy Giles joins CovertSwarm as Head of Adversary Simulation for North America
CovertSwarm welcomes Billy Giles as Head of Adversary Simulation for North America. With over 24 years of U.S. Air Force cyber operations experience, Billy strengthens our Constant Cyber Attack™ capabilities and accelerates our offensive security growth across the region.
Anatomy of a Breach: Inside the Modern Retail Attack
Retail breaches don’t start with ransomware. They start with people. From social engineering to persistent access, attackers exploit the unseen gaps in your defenses. Learn how modern retail attacks unfold.
CovertSwarm named a Sunday Times 2025 Best Place to Work
You deserve to love your job.
CovertSwarm Achieves ISO 22301 Certification
CovertSwarm has been awarded ISO 22301 certification, the internationally recognized standard for Business Continuity Management Systems (BCMS).
CovertSwarm Ranks #23 on Clutch 100 Fastest-Growing Companies in 2025
Clutch has recognized us for achieving one of the highest revenue growth rates from 2023 to 2024.