Team Evolve Security

The Signal Volume 003: Four of September's five most exploited flaws hit firewalls and VPN gateways. See the threat actors, CVEs, and fixes that mattered most in September 2026.

Evolve Security joins Anthropic's Cyber Verification Program, giving OSOC operators full, unthrottled Claude access for authorized red team and AI pen testing.

The Signal Volume 002: 5 CVEs exploited in the wild, 29 CISA KEV additions, 4 active threat actors, including Lazarus Group and two ransomware operators. Here's what your team needs to patch first.

Introducing The Signal — our new monthly threat digest from the OSOC, kicking off with July's 5 actively exploited CVEs, 17 CISA KEV additions, and a ColdFusion flaw weaponized two hours after disclosure.

Quarterly pentests couldn't keep pace with an LLM-powered investment platform. See how continuous penetration testing closed the gap, with critical vulnerabilities validated in 24 hours, not months.

Evolve Security has been selected as one of 20 cybersecurity services firms featured in Momentum Cyber's 2026 Market Report, chosen from more than 15,000 firms across the United States.

Point-in-time pen tests are already stale the moment your system prompt changes. Here's why continuous testing is now the baseline for AI security.

AI security risks like prompt injection and LLM data flows require a new kind of champion. Discover how the AI AppSec Champion model helps engineering teams catch vulnerabilities before they become breaches.

Shadow AI is Shadow IT at a different scale of risk. Learn how to find unauthorized LLM integrations in your environment, assess what they expose, and build a governance program your engineering teams will actually use.

Prompt injection is OWASP's #1 LLM risk, and most security teams aren't testing for it. A practitioner's guide to finding it before attackers do.

ROI on Continuous Penetration Testing (CPT): Annual Penetration Testing Is Failing Modern Security Programs

Explore a fictional case study of Lunera Capital, a mid-sized financial firm that adopted Continuous Threat Exposure Management (CTEM). See how theory meets practice and how this company goes from chaos to clarity in cybersecurity.

This episode breaks down Evolve Security’s CTEM Maturity Model—helping you see where your program stands, what ‘good’ looks like, and how to communicate real progress. Move beyond patch rates to strategic outcomes with a practical roadmap for Scope, Discovery, Prioritization, Validation, and Mobilization.

Transform vulnerability data into decisive action with Evolve Security’s CTEM Phase 6. Assign clear ownership, rank threats by true risk, deploy rapid-response teams, and monitor KPIs to eliminate critical issues quickly and reduce measurable risk.

This episode walks you through building a validation plan, choosing the right testing techniques, and translating results into business impact. No more assumptions—just confirmed risks and clear action paths.

Prioritize what matters most. Learn how CTEM Phase 3 helps security teams focus on exposures that truly impact the business.

CTEM-style discovery helps you zero in on what really puts your business at risk—uncovering critical exposures like misconfigurations, privilege escalation paths, and forgotten internet-facing assets—so you can act faster, reduce risk smarter, and prove security impact with confidence.

Many CTEM programs fail by scoping too broadly too soon, leading to data overload and stalled progress. This post explains how focused, business-aligned scoping lays the groundwork for meaningful, manageable CTEM cycles that demonstrate value quickly and build long-term credibility.

Drowning in vuln scan results? Still chasing the same findings quarter after quarter? CTEM (Continuous Threat Exposure Management) offers a way out of reactive chaos. This post kicks off our six-part series with a clear look at what CTEM is, why it matters now more than ever, and how it can help security teams focus on what truly reduces risk—not just what creates noise.

Evolve Security is leveling up its go-to-market strategy with a major leadership addition. Ray Ruemmele, a highly experienced cybersecurity executive, joins as Chief Revenue Officer to drive growth and expand market reach.

Evolve Security proudly announces Mark Carney as its new CEO, bringing 25 years of cybersecurity leadership to drive the company’s next phase of growth. Following a record-breaking 2024, the company continues to lead in offensive security with innovations in its Darwin Attack® platform and expanded client solutions.

Evolve Security has announced Jason Rowland as its new Chief Delivery Officer. With over 20 years of experience leading top-tier cybersecurity teams, Rowland will oversee delivery operations, product management, and customer success, driving innovation and excellence.

Evolve Security, a leader in offensive cybersecurity, announced the appointment of Mark Carney as its new President. Carney, with over 25 years of experience in cybersecurity, will focus on accelerating growth and expanding go-to-market strategies.

Victor Marchetto prepares for DORA, the EU's new act boosting financial sector resilience by 2025.

Explore the latest insights from Evolve Security's Offensive Security team in their June 2024 pentest findings. Discover critical vulnerabilities such as NBNS and LLMNR spoofing, PHP RCE, and the persistent threat of EternalBlue. Learn essential fixes and strategies to fortify your network against these exploits, emphasizing proactive security measures and the shift towards Continuous Pentesting for enhanced resilience. Stay ahead in safeguarding your systems with Evolve Security’s expert recommendations.

Evolve Security, a global leader in the domains of penetration testing and Attack Surface Management, has once again been recognized as a top vendor in the 2023 Gartner® Hype Cycle™ for Application Security.

Assessing an organization's cybersecurity posture is crucial in identifying risks and vulnerabilities, prioritizing remediation efforts, and providing a roadmap to enhance resilience against evolving cyber threats.

Get to know our Director of People Operations Sarah Thomas, her take on "work-life symbiosis" and learn about the new policies we've put in place to help our employees' health and wellness.