Home / Guides

Guides

Short, practical guides for the decisions that come up before an engagement.

29 published · newest first

  • OWASP API Security Top 10 testing

    The 2023 OWASP API list, category by category, with what a manual tester does for each and what a scanner cannot prove.

    · 6 min read

  • ISO 27001 gap assessment cost in Australia

    Published 2026 Australian estimates for an ISO 27001 gap assessment, what moves the price and what you should receive.

    · 5 min read

  • Cloud security review checklist for AWS and Azure

    Eight checks shared by the AWS Security Pillar, the Microsoft cloud security benchmark and the CIS Benchmarks.

    · 5 min read

  • How to stop your LLM generating tokens after a user cancels

    Steps from Sorami tests on vLLM 0.31.0 and SGLang 0.5.21 behind two gateways. Close the socket and abort stale retries. Test the gateway and log engine-side terminals.

    · 5 min read

  • ASD Essentials vs Essential Eight

    ASD launched the Essentials on 15 October 2026. Maturity levels give way to effectiveness ratings, and ML2 results do not carry over automatically.

    · 5 min read

  • PCI SSC AI guidance and AI agent scope

    PCI SSC published Security Considerations for AI Systems on 15 September 2026. Tokens plus a detokenise tool count as access to card data.

    · 5 min read

  • Ollama CVE-2026-103663

    CERT Polska disclosed a path traversal in the Ollama pull API on 8 October 2026. Upgrade to 0.35.0 and keep port 11434 private.

    · 5 min read

  • vLLM 0.31.0 security advisories

    Two high-severity vLLM advisories, fixed in 0.31.0, carry no CVE ID. What they cover and how to check your servers.

    · 5 min read

  • MCP Python SDK token audience advisory

    Two MCP Python SDK advisories: token audience and request body size. The audience fix needs a code change as well as an upgrade.

    · 5 min read

  • CVE-2026-99999: PwnEscape and Linux host patching

    What the Linux CNA, PWNAI and Vercel report about PwnEscape. Host-side prerequisites, impact boundaries and evidence for patching.

    · 5 min read

  • PSPF Direction 002-2026 legacy technology stocktake

    Federal entities must stocktake legacy systems by 31 March 2027. Who the Direction binds, the SoGS deadline and what suppliers should prepare.

    · 5 min read

  • ASD Cyber Action Year 2026 critical actions

    ASD lists five critical actions for 2026. What each one means in practice, and the post-quantum dates to plan around.

    · 5 min read

  • Privacy Act Tranche 2 72-hour breach notice

    The exposure draft proposes a 72-hour breach notice to the OAIC and a fair and reasonable test. It is not law yet.

    · 5 min read

  • Advisory AA26-281A explained

    Ten agencies including ASD describe MicroScan, EBurst and SoftEther. The techniques, and the checks to run first.

    · 5 min read

  • Ransomware payment reporting in Australia

    Businesses with AUD 3 million turnover must report a ransom payment to ASD within 72 hours. Who is covered and what the form asks.

    · 4 min read

  • SOC 2 vs ISO 27001 for Australian teams

    Compare CPA reporting and ISMS certification. Indicative evidence overlap, separate assurance boundaries and questions for your buyer.

    · 5 min read

  • We tested NVIDIA OpenShell

    Sorami tested NVIDIA OpenShell v0.1.2. The default policy held. Four operator settings let data out, and this is the list to check.

    · 6 min read

  • How to secure Ray and vLLM on Kubernetes

    One-cluster Ray reachability tests and ingress controls. Reproduce the port checks, distinguish namespace rules from caller authentication, and read the encryption limits.

    · 5 min read

  • How to disable YouTube auto-translated titles

    YouTube translates titles and adds AI voice tracks without an opt-out. Why it happens and how to see the real spoken language before clicking.

    · 5 min read

  • Self-replicating prompt injection

    OpenAI showed prompt injections that copy themselves between AI agents. What it found and a checklist to stop the spread.

    · 6 min read

  • How an OpenAI agent used DNS to get around its sandbox

    Web access was blocked but DNS was not. What OpenAI’s misalignment report says happened, how DNS tunnelling works, and the egress controls agents need.

    · 6 min read

  • Stake and DriveWealth data breach

    Contact details and account snapshots were exposed at Stake’s US broker. What was not taken, and a checklist for affected customers.

    · 5 min read

  • September 2026 ISM AI agent controls

    Eight controls now govern AI agents, quoted from the source. None carries an Essential Eight mapping, so nothing you already report covers them.

    · 4 min read

  • SOC 2 and ISO 27001 cost in Australia

    Neither has a published price, and the two inputs that set an ISO 27001 fee are both unpublished. Third-party estimates, attributed to the source that published them.

    · 4 min read

  • Cloud Security Review vs Penetration Test

    A configuration audit maps control plane and IAM exposure. An offensive test proves exploit paths. When each approach is needed.

    · 4 min read

  • Essential Eight ML2 for AWS and Azure

    The ASD model was written for managed fleets. This maps all eight strategies onto cloud services, and names the two that do not map.

    · 6 min read

  • SOC 2 Type I vs Type II

    The two reports attest different things. The contract wording usually tells you which one you need.

    · 4 min read

  • What a penetration test report should contain

    The nine parts of a usable report, and how to tell a scanner export from a manual test.

    · 4 min read

  • How to scope a penetration test

    Seven steps from driver to retest terms, the counts testers price on, and a copyable pre-engagement checklist.

    · 6 min read

Where these point

The services behind the guides.

Reading the report guide alongside a real document helps. Our illustrative penetration test report (PDF) is a 19-page example built from synthetic findings. It shows the deliverable, and it is not a client report.

Questions before you book

Practical answers.

Do I have to give an email address?

No. Every guide is on the page in full, with no form, no gate and no follow-up sequence. If you want to talk afterwards you can start a scoping conversation, and if you do not, nothing happens.

How current are these?

Each guide carries a last reviewed date at the top. Where a guide cites a standard it names the version and links the primary source, so you can check whether the source moved before you trust the guide.

Can we reuse these internally?

Yes. Paste the checklists into your own RFP, ticket or runbook. A link back is appreciated and is not required.

Let’s scope it

Need the work, not the reading?

Send the requester wording and your deadline. We confirm scope and fee before anything starts.

Send an enquiry

Last reviewed: