Skip to content
Mighty Infosec

Blog

Research from the offensive side.

Practical write-ups on AppSec, pentesting, threat modeling and AI security. New posts regularly.

Application Security·8 min read

Case Study: How a Simple Race Condition Bypassed Business Logic on a Global SaaS Platform

A technical deep-dive into a critical TOCTOU race condition uncovered during a client penetration test: exploiting concurrency in subscription seat limits, parallel HTTP/2 attacks, and engineering race-resilient backends.

Penetration Testing·5 min read

SOC 2 Penetration Testing: Requirements, Scope & What Auditors Actually Look For

A complete guide for SaaS and engineering leaders preparing for SOC 2 Type 1 and Type 2 compliance: testing scope, scanner vs manual testing, auditor expectations, and re-testing timelines.

AI Security·5 min read

Threat Modeling AI Agents & MCP: A Practical Security Guide for Autonomous LLMs

How to identify trust boundaries, prevent prompt injection, secure tool calling, and threat model Model Context Protocol (MCP) servers in production AI agent systems.

Penetration Testing·5 min read

Web Application Penetration Testing Checklist: The 2026 Developer & Security Guide

A comprehensive, practical web application penetration testing checklist covering modern authentication, IDOR, SSRF, business logic flaws, and API boundaries.

Find your vulnerabilities before attackers do.

Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.

Book a free scoping callView sample report