HIPAA violation costs: what the $1.5M settlement forensics actually showed
Sienna VanceApril 29, 2026
Key takeaways
OCR HIPAA investigations do not fine organizations for being breached — they fine organizations for being unable to demonstrate that required administrative, physical, and technical safeguards were implemented and maintained. The breach triggers the investigation; the evidence gap determines the penalty.
The most common documentation failure in OCR resolution agreements is the risk analysis: HIPAA requires a thorough, accurate, and organization-wide assessment of risks to PHI, and OCR's enforcement record shows that risk analyses limited to IT systems, excluding medical devices, cloud storage, or business associate data flows, do not satisfy this requirement.
In Vulnox assessments of healthcare environments, 47 of 63 environments with network segmentation had lateral movement paths between supposedly isolated segments — typically through legacy shared file servers or misconfigured firewall rules that had been in place for years without review.
Medical device patch deferral documented as a risk-based decision satisfies HIPAA Security Rule requirements. Medical device patch deferral undocumented — the default in most healthcare organizations — creates an evidence gap that OCR treats as a failure to implement technical safeguards.
Business associate agreements that satisfy HIPAA's contract requirements do not transfer liability for a BA's security failure. OCR has pursued covered entities for breaches originating in business associate environments when the covered entity could not demonstrate adequate vendor oversight.
TL;DR
The $1.5M settlement in this case was not the cost of the breach. It was the cost of the evidence gaps the breach exposed. OCR investigators found an organization that had deferred medical device patching without documenting the decision, deployed network segmentation it had never tested, monitored EHR audit logs it had never actually reviewed, and signed business associate agreements it had never verified through security assessment. Each of those failures has a specific HIPAA regulatory citation. The fine is a regulatory evidence problem as much as a security problem, and the two require different remediation.
What the OCR investigation actually found
The breach began on a GE Healthcare PACS workstation in radiology, running Windows 7 on a patch cycle that had effectively stopped in January 2020. A phishing email impersonating a medical supply vendor delivered a Cobalt Strike beacon. Within six hours, the attacker had pivoted from the radiology VLAN to the billing department via a shared file server that the network team believed was isolated — the server had been forgotten in the VLAN configuration review and was bridging two supposedly separate segments with default credentials intact. By hour 48, ransomware had encrypted critical systems and PHI covering approximately 85,000 patients had been exfiltrated.
The breach cost was not $1.5M. The breach cost was recovery expenses, operational downtime, and notification obligations. The $1.5M was the OCR resolution agreement — the penalty for what investigators found when they examined the evidence record around the breach, not the breach itself.
OCR's investigation identified four documentation failures that formed the basis of the resolution agreement: no evidence of a risk analysis that covered medical devices and imaging systems; no documentation of the risk-based decision to defer Windows 7 patching on PACS workstations; EHR audit log retention that met HIPAA's technical requirements but no evidence of active monitoring; and a business associate agreement with the transcription service vendor that had never been supported by a security assessment of that vendor's environment. The ransomware was the incident. The resolution agreement was the invoice for four years of compliance theater.
The organization's position going into the OCR investigation: 'We have a HIPAA compliance program. We have policies, BAAs, and annual training. The breach was a sophisticated attack.' OCR's position after reviewing the evidence: 'The sophistication of the attack is not the relevant question. The relevant question is whether you implemented the required safeguards. The documentation does not show that you did.'
What HIPAA enforcement data shows about where penalties actually come from
$1.5M resolution agreement
OCR resolution agreement value in the case reconstructed in this article — determined not by the volume of PHI compromised or the sophistication of the attack, but by the number of HIPAA Security Rule provisions the organization could not demonstrate compliance with through documentary evidence at the time of investigation. The fine scaled with the evidence gaps, not with the breach impact. (OCR Resolution Agreement, case details anonymized)
94% of OCR resolution agreements
Share of OCR HIPAA enforcement resolution agreements between 2019 and 2023 that cited inadequate risk analysis as a contributing violation — making risk analysis documentation failure the single most consistent factor in HIPAA penalty determinations, appearing more frequently than any specific technical safeguard failure. (HHS OCR Resolution Agreements and Civil Money Penalties, hhs.gov)
47 of 63
Healthcare client environments assessed by Vulnox with documented network segmentation where assessment found lateral movement paths between supposedly isolated segments — typically through legacy shared services, misconfigured firewall rules, or forgotten bridging infrastructure that had never been included in a segmentation validation exercise. (Vulnox assessment data, 2024)
$14,000 per violation per day
Maximum HIPAA civil monetary penalty for continuing violations in the 'reasonable cause' tier — the penalty category that applies when an organization knew or should have known about a compliance gap but did not correct it. Undocumented medical device patch deferral that spans multiple years falls into this category when OCR can show the vulnerability was publicly known. (HHS HIPAA Enforcement Rule, 45 CFR Part 160)
The organizations with the most complete HIPAA compliance documentation often have the largest evidence gaps under OCR investigation
Common belief
Healthcare organizations that have completed formal HIPAA compliance programs — annual risk analyses, updated policies, signed BAAs, workforce training records — are better positioned in OCR investigations than those without formal programs.
What we found
In a 200-bed regional hospital assessed by Vulnox, the compliance officer confirmed that a risk analysis had been completed eight months earlier and filed with HIPAA documentation. The risk analysis scope explicitly excluded 'medical devices managed by biomedical engineering' on the basis that those systems were under vendor support contracts. The Vulnox assessment found 34 networked medical devices on the clinical network, 19 of which were running operating systems with publicly known unpatched vulnerabilities. The risk analysis said those systems were out of scope. OCR's position on out-of-scope medical devices that process or transmit PHI is that they are not out of scope — they are gaps in the risk analysis.
The pattern Sienna Vance sees consistently in post-breach regulatory work runs the other direction in a specific and predictable way. Organizations that completed documentation-first compliance programs used documentation completion as the signal that compliance was achieved. Risk analyses were conducted and filed. Policies were written and distributed. BAAs were signed and stored. The compliance calendar was maintained.
OCR does not evaluate HIPAA compliance by reviewing whether documentation exists. It evaluates whether the documentation demonstrates that required safeguards were actually implemented and remain effective. A risk analysis completed in 2021 that does not address medical devices is not a compliant risk analysis — it is a document that creates a false record of compliance without satisfying the regulatory requirement. A BAA signed with a transcription vendor is not evidence of vendor oversight — it is a contract. OCR asks for evidence of the security assessment that preceded or followed it.
The organizations where documentation-first compliance programs create the most dangerous exposure are those where the compliance team and the security team operate separately. The compliance team files the risk analysis. The security team runs the vulnerability scanner. Neither team has validated that the risk analysis scope covers what the scanner is actually finding, or that the scanner is covering what the risk analysis says is in scope. The documentation creates plausible compliance. The investigation finds the gap between what was documented and what was real.
How HIPAA's evidence standard works and why most compliance programs do not meet it
HIPAA's Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect electronic PHI. The word 'implement' carries specific regulatory meaning that most compliance programs misapply. Implementation under the Security Rule means that the safeguard is in place, functioning, and documented in a way that allows demonstration of its effectiveness to an external reviewer.
OCR's investigation methodology starts from the breach timeline and works backward through the evidence record. For each safeguard relevant to the breach, investigators ask three questions: Was it required? Was it implemented? Is there documentation demonstrating that it was implemented and remained effective up to the point of the breach?
The third question is where most organizations fail. A policy requiring quarterly review of user access rights is evidence that the safeguard was required and an attempt was made to implement it. It is not evidence that the review actually occurred. OCR asks for the review records — the dated outputs showing which accounts were reviewed, what decisions were made, and who authorized changes. Organizations that have policies but not records have documented their intent without demonstrating their execution.
For medical device patching specifically, the Security Rule does not require that every device be patched on a specific schedule. It requires that the organization implement security measures sufficient to reduce risks to a reasonable and appropriate level. Deferring a patch on a clinical device because the vendor has not validated the patch against the device's operating parameters is a defensible risk-based decision — if documented at the time the decision was made, reviewed periodically, and recorded as a known exception with compensating controls. Deferring patches because nobody on the IT team wanted to touch clinical devices is the same operational outcome with no documentation and no compensating controls, and it is the difference between a defensible position and a $14,000-per-day continuing violation.
Example
The PACS workstation in this case was running Windows 7 that had not received security updates since January 2020, when Microsoft ended extended support. The organization's IT team knew about the end-of-support status. There was no documentation of a risk assessment of the PACS workstation's PHI exposure, no documented risk-based decision to defer upgrade, no compensating controls documented (network isolation, EDR, traffic monitoring), and no vendor engagement record about upgrade timeline. OCR found a workstation that had been knowingly operated in an unsupported state for over three years, processing PHI, with no evidence that anyone had assessed or documented the risk. The Cobalt Strike beacon was the incident. The three years of undocumented risk deferral was the violation.
The regulatory distinction matters practically: if the organization had documented the patching deferral decision with a risk assessment, identified compensating controls (network isolation from general IT traffic, EDR deployment on the workstation, traffic monitoring at the VLAN boundary), and scheduled an annual review of the exception, the same operational state — unpatched Windows 7 PACS workstation — would have a defensible evidence record. The breach might still have occurred. The OCR fine might not have.
What OCR investigators request versus what compliance programs typically produce
Risk analysis documentation
HIPAA requires a thorough, accurate, and organization-wide risk analysis that covers all ePHI regardless of where it resides or what system processes it. Most compliance programs produce risk analyses scoped to primary IT systems and EHR infrastructure. Medical devices, cloud storage used by clinical staff, business associate data flows, and shadow IT are frequently excluded. OCR investigators request the risk analysis and evaluate its scope against the organization's actual ePHI environment — gaps between documented scope and actual ePHI locations become violations.
A risk analysis that excludes PACS workstations, infusion pump networks, or cloud storage accounts used by clinical staff satisfies the documentation requirement superficially while failing OCR's scope standard. The document exists. It does not demonstrate what it is supposed to demonstrate. Healthcare organizations that conduct risk analyses through compliance consultants who scope to 'primary systems' should verify that medical devices and non-EHR data flows are explicitly addressed.
Business associate agreement and vendor oversight
HIPAA requires covered entities to obtain satisfactory assurances from business associates that they will appropriately safeguard PHI. A signed BAA is evidence of the contract, not of the assurance. OCR resolution agreements have cited covered entities for BA-originated breaches when the covered entity could not produce evidence of security assessments, ongoing vendor oversight, or response to known security deficiencies in the BA's environment. The BAA is the starting point; the ongoing oversight is what OCR evaluates.
Healthcare organizations with comprehensive BAA libraries that have never been followed up with security assessments of high-risk vendors have satisfied the contract requirement and not the oversight requirement. The transcription vendor in this case had a signed BAA. It also had unencrypted audio recordings of patient consultations stored on a server with default credentials. OCR asked for evidence of the covered entity's oversight activities. There were none.
Audit log monitoring
HIPAA's Technical Safeguards standard requires audit controls — hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI. The standard has two components: recording and examining. Many organizations satisfy the recording component by enabling EHR audit logging. OCR asks for evidence of the examining component — records of log review activity, documented procedures for log analysis, and evidence that anomalies identified in logs were investigated. Log retention is infrastructure. Log review is a process. OCR evaluates both.
An EHR with audit logging enabled and 90-day log retention satisfies the technical infrastructure requirement. It does not demonstrate that anyone reviewed the logs. In this case, audit logs showed the attacker modifying patient demographics to facilitate fraudulent billing over a period of 18 days. The modification activity was visible in the logs. Nobody was reviewing the logs. HIPAA's audit control standard was technically met and operationally not met — and OCR's investigation found both.
What Vulnox assessments find in HIPAA-regulated environments
Assessment base: Pattern observations from Vulnox vulnerability assessments and compliance gap analyses of covered entities and business associates, 2023–2024.
Network segmentation deployed but never validated, with lateral movement paths in the majority of assessed environments
In 47 of 63 healthcare client environments where network segmentation was documented in HIPAA compliance materials as a technical safeguard, Vulnox assessment found at least one lateral movement path between supposedly isolated network segments. The most common mechanism was a legacy shared file server that predated the segmentation implementation and had not been included in the VLAN configuration review. These servers typically had default or weak credentials, no EDR deployment, and no traffic monitoring. The segmentation policy said they were isolated. The network configuration did not enforce that isolation.
HIPAA compliance documentation listed network segmentation as a technical safeguard. OCR investigators evaluating that documentation after a breach would ask for evidence that the segmentation was effective — a validation test, a penetration test, or a network configuration review. The documentation describes a control that was not functioning. The compliance record creates a more damaging evidentiary position than no documentation, because it demonstrates that the organization knew segmentation was required, documented it as implemented, and either did not test it or knew it was failing.
Medical device risk exceptions undocumented across the majority of assessed environments
In Vulnox assessments of hospital and health system environments, medical device patch deferral was universal — every environment had networked clinical devices running operating systems beyond vendor-supported patch currency. What varied was whether the deferral was documented as a risk-based decision with compensating controls or simply undocumented. The majority had no documentation. IT teams acknowledged knowing about the patch status and described the operational reasons for deferral accurately, but no written risk assessment, no compensating control documentation, and no exception review record existed.
The operational decision to defer patching on clinical devices is frequently defensible on patient safety and vendor support grounds. The absence of documentation of that decision is not defensible under HIPAA. OCR does not require that every device be patched. It requires that risks be assessed and managed. An undocumented deferral looks identical to an unaware deferral in an investigation record — and an unaware deferral is a safeguard implementation failure.
EHR audit log infrastructure meeting technical requirements with no evidence of review activity
Across Vulnox compliance gap analyses of covered entities, EHR audit logging was enabled in every environment assessed. The technical infrastructure for HIPAA's audit control requirement was uniformly present. In the majority of those environments, there was no documented procedure for log review, no assigned responsibility for log analysis, no record of review activity, and no record of any anomaly ever being identified through log review. Logs were being generated and retained. The examining component of the audit control standard was absent.
OCR's audit control standard explicitly requires both recording and examining activity. An environment with robust log retention and no review process satisfies half the requirement. Post-breach, OCR will request evidence of log review activity going back to the breach entry point. An organization that cannot produce that evidence has a gap in its evidence record that is independent of whether the logs would have detected the breach if someone had been looking at them.
What covered entities say before compliance gap analyses and what the evidence shows underneath
'We passed our last HIPAA audit. Our compliance program is current.'
Root cause:HIPAA audits — whether conducted by OCR, a business associate, or a third-party compliance firm — evaluate documentation against the regulatory standard at a point in time. They assess whether required documents exist and whether they reference the right regulatory provisions. They do not validate that documented controls are operationally effective, that risk analysis scope matches actual ePHI locations, or that process requirements like log review and access review are being executed. An organization can pass a documentation audit while operating with network segmentation that has never been validated, audit logs that have never been reviewed, and medical devices that have not been patched in three years.
'We have BAAs with all our vendors. Our business associate risk is managed.'
Root cause:A BAA is a legal instrument that establishes obligations. It is not evidence that those obligations are being met. HIPAA requires covered entities to obtain satisfactory assurances that business associates will appropriately protect PHI — and OCR's enforcement record makes clear that 'satisfactory assurances' requires more than a signed contract. It requires evidence of oversight: security assessments of high-risk vendors, review of vendor security practices, and documented response to known security deficiencies. Organizations with comprehensive BAA libraries that have not assessed vendor security have a contract program, not a vendor risk management program.
'The breach was a sophisticated ransomware attack. We were a victim, not a violator.'
Root cause:OCR does not investigate whether the attack was sophisticated. It investigates whether the organization had implemented required safeguards. The sophistication of the attack is relevant to whether the breach was preventable; it is not relevant to whether HIPAA's administrative, physical, and technical safeguard requirements were met. Organizations that frame their OCR response around the sophistication of the attack are addressing the wrong question. The question OCR is asking is: show us the risk analysis, the access review records, the audit log review procedures, the medical device risk exception documentation. The answer to those requests determines the resolution agreement amount.
The corrective action sequence that addresses both the security gap and the evidence gap
Medical device risk exception documentation. IT teams know which devices are unpatched and why. The operational knowledge exists. The documentation does not. Converting operational knowledge into a formal risk exception register requires an afternoon of documentation work per device category and creates the single most defensible evidence record for the most common HIPAA technical safeguard gap in healthcare environments.
- 1Compliance officer with security team input
Conduct a risk analysis scope review against the actual ePHI environment — not against the IT asset register. Document every location where ePHI is created, received, maintained, or transmitted, including medical devices, cloud storage used by clinical staff, business associate data flows, and any system outside the EHR infrastructure. Where the current risk analysis scope does not cover a location in that inventory, document the gap and the remediation timeline. The scope gap is the most common OCR finding and the easiest to address before an investigation rather than during one.
Expected outcomeA risk analysis whose documented scope matches the organization's actual ePHI footprint. OCR investigators will compare the risk analysis scope to the breach timeline's infrastructure. Scope gaps visible in that comparison become violations. Scope gaps corrected before investigation become evidence of a functioning compliance program.
- 2IT security team
Validate network segmentation through active testing, not configuration review. Configuration review verifies that VLAN assignments and firewall rules match documentation. Active testing verifies that traffic cannot traverse segment boundaries — including through legacy shared services, misconfigured rules, and infrastructure that predates the segmentation implementation. Document the validation methodology, the date, the systems tested, and the findings. For every lateral movement path found: document it as a known exception, implement compensating controls, and schedule remediation. The documentation of a known exception with compensating controls is a defensible HIPAA position. An undocumented lateral movement path found by OCR investigators is not.
Expected outcomeA segmentation validation record that demonstrates the control was tested, not just documented. In 47 of 63 Vulnox-assessed healthcare environments, the segmentation the compliance program described as a technical safeguard had never been validated. The testing finds the legacy shared server before OCR does.
- 3IT security team with biomedical engineering
For each medical device running an operating system beyond supported patch currency: document the patch deferral as a formal risk exception. Record the device, the operating system and patch status, the clinical reason for deferral, the vendor support position, the compensating controls in place (network isolation parameters, traffic monitoring, EDR if supported), and the review schedule. Review and re-sign each exception annually. This does not require patching the devices. It requires that the risk decision be documented in a way that demonstrates HIPAA's risk management requirement was met.
Expected outcomeA medical device risk exception register that allows OCR investigators to see that every unpatched device was known, assessed, and managed with documented compensating controls — rather than the default position, which is that the device was unpatched and nobody had assessed or documented the risk.
- 4Compliance officer
Establish a documented EHR audit log review procedure: who reviews logs, on what schedule, what triggers an escalation, how review activity is recorded. The review does not need to be exhaustive — risk-based review of high-sensitivity access patterns, bulk record access, access outside normal hours, and modifications to demographic or billing data covers the highest-risk activity categories. Record each review session with date, reviewer, scope, and any anomalies identified. This creates the evidence of the examining component of HIPAA's audit control requirement that most organizations are missing.
Expected outcomeAn audit log review record that demonstrates active monitoring. The review records serve two functions: they are the primary mechanism for detecting the kind of fraudulent billing modification that occurred in this case, and they are the evidence OCR requests when investigating whether the organization was operationally monitoring its ePHI systems.
- 5Compliance officer with legal counsel
Identify the five highest-risk business associates by volume and sensitivity of PHI shared. For each: conduct or request a security assessment covering their technical safeguard implementation, not just their BAA compliance. Document the assessment, its findings, and any remediation requirements communicated to the vendor. Repeat on a risk-based schedule — at minimum when the BA relationship changes significantly and annually for the highest-risk vendors. This is not due diligence theater. It is the oversight evidence OCR will request if a breach originates in a BA environment.
Expected outcomeA vendor oversight record demonstrating that BAAs are supported by actual security assurance activities. OCR resolution agreements that cite BA-originated breaches consistently show covered entities that had signed BAAs and had no oversight records. The assessment records are the difference between a correctable compliance gap and a contributing violation.
Further Reading
Vulnerability Assessment
comprehensive vulnerability assessmentDigital Footprint
detailed digital footprint analysisHIPAA compliance framework guide: Security Rule, HICP, and the 2013 Omnibus
HIPAA violation costs and forensic evidence gapsHIPAA Official Homepage
HIPAA official regulationsNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideOWASP Web Security Testing Guide
OWASP web security testing
Frequently Asked Questions
What does OCR actually investigate after a HIPAA breach, and what determines the fine amount?
OCR investigations start from the breach timeline and work backward through the evidence record. For each HIPAA Security Rule safeguard relevant to how the breach occurred — risk analysis, access controls, audit logging, network segmentation, patch management, vendor oversight — investigators ask whether the safeguard was implemented and whether documentation demonstrates it was implemented and remained effective. The fine is determined by the number of violations found and their duration, not by the volume of PHI compromised or the sophistication of the attack. In OCR resolution agreements, inadequate risk analysis appears as a contributing violation in approximately 94% of cases — it is the most consistent determinant of penalty amount.
What makes a HIPAA risk analysis compliant under OCR's evidence standard?
HIPAA requires a thorough, accurate, and organization-wide risk analysis covering all ePHI regardless of where it resides. OCR's enforcement record shows that risk analyses scoped only to primary IT systems and EHR infrastructure consistently fail this standard when the investigation finds ePHI in medical devices, cloud storage used by clinical staff, or business associate environments not covered by the analysis. A compliant risk analysis documents every location where ePHI is created, received, maintained, or transmitted — including networked medical devices — identifies risks at each location, and records the risk management decisions made for each identified risk. Excluding medical devices from scope because they are managed by biomedical engineering does not satisfy OCR's organization-wide requirement.
Does a signed business associate agreement protect a covered entity when the BA causes a breach?
A signed BAA establishes contractual obligations but does not demonstrate the oversight that HIPAA requires. OCR has pursued covered entities for BA-originated breaches when the covered entity could not produce evidence of security assessments, ongoing oversight activity, or response to known BA security deficiencies. The regulatory standard is 'satisfactory assurances' that the BA will protect PHI — and OCR's enforcement position is that a signed contract without supporting oversight evidence does not demonstrate satisfactory assurances. Covered entities that have comprehensive BAA libraries but no record of vendor security assessments have the contract infrastructure without the oversight evidence OCR requests.
What does HIPAA's audit control standard actually require, and why do most organizations only meet half of it?
HIPAA's Technical Safeguards standard for audit controls requires both recording and examining activity in systems containing ePHI. Most healthcare organizations satisfy the recording requirement by enabling EHR audit logging and maintaining retention periods. The examining requirement — documented procedures for log review, assigned responsibility, review activity records, and documented investigation of anomalies — is absent in the majority of environments Vulnox has assessed. OCR requests evidence of both components. An organization with robust log retention and no log review records has satisfied the infrastructure requirement and not the process requirement, and the gap is visible to investigators reviewing the evidence record against the breach timeline.
Is deferring medical device patches a HIPAA violation?
Deferring medical device patches is not automatically a HIPAA violation. HIPAA's Security Rule requires organizations to implement security measures sufficient to reduce risks to a reasonable and appropriate level — it does not mandate specific patch timelines. A documented risk-based decision to defer a patch, with recorded compensating controls and a scheduled review, satisfies this standard. Undocumented deferral — the default in most healthcare environments — does not. OCR cannot distinguish between an organization that assessed the risk and made a defensible decision and one that simply never addressed the issue, because both look identical in the absence of documentation. The violation is the evidence gap, not the deferral itself.
What did the network segmentation failure in this case show about HIPAA technical safeguard validation?
The organization had documented network segmentation as a HIPAA technical safeguard in its compliance materials. The segmentation had never been validated through active testing. A legacy shared file server that predated the VLAN implementation was bridging the radiology and billing network segments with default credentials. In 47 of 63 healthcare environments assessed by Vulnox, documented network segmentation had at least one lateral movement path between supposedly isolated segments — typically through legacy infrastructure excluded from segmentation configuration reviews. OCR investigators evaluating a breach that traversed the segmented boundary will ask for evidence that segmentation was validated. Configuration documentation is not validation evidence.
What is the most common HIPAA compliance gap that creates OCR investigation exposure?
Inadequate risk analysis appears as a contributing violation in approximately 94% of OCR resolution agreements, making it the single most consistent factor in HIPAA penalty determinations. The gap is almost always scope: the risk analysis was conducted but excluded significant ePHI locations — medical devices, cloud storage, business associate data flows — that were relevant to the breach being investigated. The second most common gap is the absence of evidence that process requirements were actually executed: access review records, audit log review records, and medical device risk exception documentation exist as policies but not as dated activity records. OCR evaluates both the existence of required safeguards and the evidence that they were operationally maintained.
Related Articles
API security assessment: what automated tools miss and manual testing finds
Automated API security tools find the vulnerabilities they were designed to look for. The findings that matter in real assessments, broken object-level authorization, JWT algorithm confusion, and unauthenticated internal endpoints, require a tester who understands what the API is supposed to do before probing what it actually does.
CVSS score explained: what the metric captures, what it misses, and how to fix your prioritization
In 40% of Vulnox assessments, vulnerabilities scored CVSS 9.0 or higher were on systems with compensating controls that materially reduced the actual risk. The score was accurate. The priority order it implied was not. This guide covers how to use CVSS correctly and what to layer on top of it.
Post-breach vulnerability assessment: what the attacker left behind
Most post-breach assessments start too late and end too early. They confirm what was hit, not what the attacker mapped before they moved. The second breach usually comes from the reconnaissance that happened in the first.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.