Blog

A SOC 2 pen test has meant four to eight weeks and a five-figure invoice. Fencer AI pen testing returns an audit-ready report the same day you scope it, for $3,000 a year.

Most AI penetration testing tools are just vulnerability scanners. What separates a genuine AI pen test, and the common myths worth setting straight.

Free SAST, SCA, secrets, and GitHub config scanning for public repositories. No credit card. Works with SecretSpec for better secrets management.

Not all pen testing tools work the same way. 9 options compared across proof of exploit, remediation, pricing, and compliance output.

Compare Fencer's next-generation attack surface management to leading ASM tools like Cortex Xpanse, Defender EASM, and Wiz, and see why growth-stage teams pick Fencer.

Cursor recently shipped Origin, its own git hosting. Fencer now scans Origin pull requests with SAST, AI review, AI triage, and autofix PRs. Available to all customers today.

We compared 10 SAST tools on what happens after detection: triage, investigation, and the review workflow that turns a finding into audit-ready evidence.

We built an SPDX license classifier in pure Python that matches a Go-based tool on speed and accuracy, with a simpler dependency and packaging story. Here's how.

Modern SAST is three jobs, not one: classical scanners for detection, AI triage to clear false positives, and investigative agents for logic bugs. Here's how they fit.

We ran Claude Code's /security-review over 50 real pull requests. It is a useful first pass for catching vulnerabilities, but not a full security program. Here's why.

Python class pollution turns getattr and setattr into RCE and auth bypass. Here is an Opengrep rule you can paste into your own ruleset to catch it in CI.

How we ingest security logs from AWS, GCP, and Azure into one Snowflake data lake: what's shared, what differs per cloud, and where each one breaks.

Azure Diagnostic Settings silently fail across subscriptions. Here's the customer-storage, cross-subscription-read pattern that actually delivers your logs.

We pentested Claude Code, Codex, and opencode with planted secrets and honeypots. Default configs all leaked credentials. Here's the open-source scanner.

We benchmarked 15 LLMs on 142 real security findings to triage SAST false positives. Kimi K3 led on accuracy, with one caveat that matters for security.

A startup CTO explains why he pushed for SOC 2 before any customer required it, and how treating it as a sales tool cut months from enterprise deal cycles.

A free tool that reads your SOC 2 the way enterprise buyers will and shows you the gaps before procurement stalls your deal.

SOC 2 is table stakes for enterprise deals. See what buyers ask in security reviews beyond the badge, and how to spot procurement gaps early.

A startup CTO on what a secrets management retrofit actually requires: configuration tangles, production risk, and why an afternoon of setup at five engineers becomes months of effort at fifty.

Secrets in the wrong places, no infrastructure observability, no code scanning. The early gaps that cost the most to retrofit — and what to get right from the start.

A quarter to half of the security tools startups need require a vendor conversation. Here's what the buying process actually looks like and how to plan for it.

Two engineering personalities shape security outcomes on lean teams: perfectionists who spiral and cynics who disengage. Here's how to manage both.

Most startup CTOs fear MDM for the wrong reasons. Here's what endpoint protection actually protects against, why native tools aren't enough, and how easy it is in 2026.

Four signs your startup's security stack is coming apart at the seams, and what to do about it.

Many startup CTOs run security as a separate program and watch velocity slow down. Here's how to budget it as part of engineering capacity instead.

A new field guide from Fencer co-founder Tim Olshansky on running security at a startup before you have a security team. Drawn from his time at Zenput.

A CVE just landed in a library your app depends on. Here's the decision framework for knowing when to patch immediately, schedule it, or accept the risk.

Security culture is the habits and shared awareness that shape how your team handles security day to day. Here's how to build it at a startup.

SOC 2 gets you in the room, but enterprise buyers still send a 200-question security questionnaire. Here's how to answer fast, and keep answering fast.

A plain-spoken guide to SOC 1, SOC 2, SOC 3, and Type I vs Type II for startup CTOs figuring out which report a prospect is really asking for.

Why passing SOC 2 doesn't mean your security program works, and what continuous security looks like after the audit letter arrives.

At 50 employees, the security controls that worked at 10 start to break down. Here's what to add, what to formalize, and how to keep security from becoming a second job.

A 45-minute monthly meeting is all it takes to manage security without a dedicated team, and it generates audit evidence as a byproduct.

A stage-specific playbook for the security controls and habits that matter when your startup has 10 employees, no security team, and a product to ship.

Your SOC 2 badge proves you documented controls. It doesn't prove you're secure. Learn why compliance alone fails and what real security looks like alongside it.

The five most common security risks for B2B SaaS companies, from stolen credentials to weak tenant isolation, and what to do about each one.

Most startups burn hours every week on security busywork that has nothing to do with reducing risk. Here are five common patterns and what to do about each.

Five MCP attack patterns every developer should understand: tool poisoning, supply chain attacks, localhost RCE, rug pulls, and overprivileged access. Real CVEs and mitigations for each.

AI coding tools ship code with exposed API keys, missing database security, and no input validation. Here are 8 security fixes every non-technical founder should ship.

The 6 security domains every startup needs from day one: identity and access, endpoints, application security, infrastructure, network, and continuous monitoring. A practical guide to getting the fundamentals right early.

Passed SOC 2 but have no security team? Learn how to keep controls running, answer questionnaires fast, manage security tooling, and prepare for your second audit.

Learn how to prioritize security vulnerabilities without a dedicated security team. A practical framework for cutting through the noise and fixing what actually matters.