CovertSwarm
About CovertSwarm
If you release code, hire people, open new premises or change your board more often than you attack yourself, you are not keeping pace with your own risk. CovertSwarm was founded in 2020 on that argument, frustrated that organizations relied on occasional penetration tests, thick reports and long gaps in between.
The Swarm runs realistic attacks across digital, physical, and social environments, then shows how weaknesses chain into paths an attacker could use against the business.
What we write about
- Continuous offensive security testing: Why occasional testing can’t keep pace with how often your organization changes.
- Emerging threats: New attack techniques and what they could let an attacker do to your organization.
- Offensive AI and AI security: Prompt injection, multi-agent risk and how attackers can turn AI and agentic systems against the organizations running them.
- Red teaming and adversary simulation: Chaining weaknesses into the attack paths a real adversary would follow.
- Regulatory threat-led testing: CBEST, STAR-FS and threat-led testing, from a team with CREST accreditation for both.
- Physical security and social engineering: Getting into buildings and past staff, and what that access exposes.
- Vulnerability research: Flaws in software and systems, and what an attacker could do with each one.
Latest posts
What is Wi-Fi Penetration Testing?
Many people in a home or work environment these days have laptops and mobile phones which need to connect to the internet via a wireless network. Although convenient, it can open up the network to attackers if not set up correctly.
Pentesting is DEAD.
Traditional ‘snapshot’ penetration testing cannot keep pace with modern rates of business and technology change. It is underpinned by an ethos that “point in time” testing is enough. And this is no longer true.
Office 365 Security Best Practices
Although Microsoft 365 has many built-in security features which can make the environment safe against attackers, this relies heavily on whether the environment has been set up properly. Many critical issues can arise when a Microsoft 365 environment has been incorrectly configured.
What is Intrusive Penetration Testing?
Intrusive Penetration Testing is Penetration Testing where the risk of potential system impact or outage is not mitigated. For example, the Penetration Tester will not throttle their activity and may affect deliverability or, through the intensity of their activity, bring systems and services down. Effectively causing a ‘denial of service’ (DoS) condition.
Application Penetration Testing
Application penetration test vs vulnerability scanning An application penetration test differs from vulnerability scanning in that it is a human-led operation. Whilst automated tools will be used, this activity is much more in-depth than just that. This type of testing…
What is Session Hijacking?
Session hijacking is an attack that consists of exploiting the web applications users' session control in order to impersonate other users who are using the application.
DevOps vs DevSecOps
Development Operations (DevOps) and Development Security Operations (DevSecOps), while sharing similar principles, have slightly different areas of concern.
Sniffing Attack
Sniffing is the technique or process of capturing (sniffing) data packets over a network. It is historically related to the harvesting of clear-text credentials transmitted due to a login action.
Retail Penetration Test
The types of penetration testing that retail stores need will directly be linked to the assets they have and what they are trying to protect.
Malicious Code
Malicious code usually performs actions against the user’s interest.
CEH Certification
CEH or Certified Ethical Hacker (EC-Council) has a recommended requirement of two years of IT experience with some basic familiarity with Linux or Unix. Additionally, it is recommended to have a good understanding of Cyber Security principles.
What is Penetration Testing Software?
Penetration testing software is the toolset of penetration testers. These range from enumeration tools such as host and port discovery to exploitation tools such as password brute-force suites and exploit generation, as well as many more.
What is a Network Penetration Test?
Network penetration tests are used to identify security weaknesses within the networks (both internal networks and external networks). This includes testing for correct network segmentation and appropriate security boundaries.
What is Enumeration in Cyber Security?
Cyber security enumeration is a process used by both security professionals and attackers alike to establish a collective knowledge of the target and its assets. Using this knowledge specific attack vectors can be used to target weak points that exist based on the information gathered.
CovertSwarm collaborates with BBC on Instagram Scam investigation
CovertSwarm is modernising the penetration testing, red teaming, and bug bounty industries with its challenger ‘Constant Cyber Attack’ service. Today, they announce yet another collaboration with the BBC: this time an investigation related to consumers being scammed via Instagram.
CovertSwarm assists BBC with telephone ‘number spoofing’ investigation
CovertSwarm's ethical hackers joined the BBC's Rip Off Britain to demonstrate Caller ID spoofing in action. See how this underestimated social engineering attack works and what businesses and consumers can do to protect themselves.
The Challenges of ethical hacking
Learn more about the different challenges presented within ethical hacking.
How to Become a Cyber Security Consultant
In this post, we'll discuss common questions on how to become a consultant within cyber security.
Is Open Source or Proprietary More Secure?
Open-source software projects are, in theory, more secure than closed-source/proprietary software due to the clear disclosure of security vulnerabilities and the potential for source code review.
Is Linux Good for Ethical Hacking?
Linux is commonly the preferred operating system used by Ethical Hackers and 'Infosec' professionals due to the following factors.
What is the Information Security CIA?
The CIA triad is a security model of three core principles used within IT security and Information Security policies within an organisation. These principles relate to the Confidentiality, Integrity, or Availability of systems or information.
What is Broken Authentication?
Broken authentication refers to a weakness in the design or implementation of access controls inherent in an online platform or application.
Can You Pentest AWS?
Unless you are working directly with AWS then you will not be able to run a pentest against the AWS cloud environment directly. You are only permitted to test against 'your' deployments of specific AWS services as detailed within the following guidance from Amazon.
Why is Python Used for Hacking?
Python is well-known as a fast, simple and easy, readable scripting or programming language. Those features make Python one of the most used languages for hacking, especially when it regards automated actions during the enumeration and exploitation phase.