Skip to content

Penetration Testing

Offensive Security Guide: BAS, CTEM, CART, Pen Test, & COST Explained

BAS, CTEM, CART, Pen Test, VA, AEV, COST: What Each Actually Does, and When to Use What

Every quarter a new three-letter acronym shows up in a vendor deck. Last year it was AEV. This year Gartner introduced COST. CTEM is everywhere. BAS has been around forever and still gets confused with red teaming. Pen test means six different things depending on who you ask. If you run a security program, the… Read More »BAS, CTEM, CART, Pen Test, VA, AEV, COST: What Each Actually Does, and When to Use What

Combinatorial Belief States Are the Cost of Explicit Uncertainty

Combinatorial Belief States Are the Cost of Explicit Uncertainty

Many objections to belief-state planning are framed as concerns about scalability. In practice, they are concerned about visibility. Systems that avoid explicit belief do not eliminate uncertainty; they merely conceal it. This concealment can appear efficient, but it comes at a cost that is paid later often at the point where decisions matter most. This… Read More »Combinatorial Belief States Are the Cost of Explicit Uncertainty

Demystifying Claude Mythos Preview: The Model That Changed Cybersecurity Forever

For most of the past decade, the trajectory of large language model research followed a familiar arc: scale up the compute, widen the data, tune the alignment, ship the product. Each new generation of models arrived with modestly improved benchmark scores, better instruction-following, and marginally reduced hallucination rates. Opus replaced Sonnet. Sonnet replaced Haiku. The… Read More »Demystifying Claude Mythos Preview: The Model That Changed Cybersecurity Forever

Diagram depicting why large language models fail at real system planning due to implicit averaging.

Why LLMs Are Not Planning Machines (And What It Means)

In the course of my work with LLMs, I’ve been examining a recurring pattern in how large language models are being used inside real systems. In many settings, I observed that LLMs are treated as planners where they are used to generate multi-step workflows, remediation strategies, operational playbooks, and even “autonomous” action sequences. These plans… Read More »Why LLMs Are Not Planning Machines (And What It Means)