Resources

Security, evidence and market decisions

Technical analysis for MSPs and security leaders: how to authorize tests, evaluate exposures, validate defenses and build services with verifiable results. Articles in English and Portuguese, with primary sources and practical criteria for making decisions.

Pentest operations · October 20, 2026 · 11 min read

Penetration testing for MSPs: authorization, evidence and retesting in a recurring service

Build an MSP pentest service around authorized scope, reproducible evidence, clear responsibilities and verification of remediation.

Security strategy · October 20, 2026 · 7 min read

CTEM in practice: from discovered exposure to verified remediation

How to connect scoping, discovery, prioritization, validation and mobilization in an exposure program built around accountability and verified remediation.

Market and managed services · October 20, 2026 · 6 min read

The cybersecurity market according to IDC: where MSPs need to prove value

Reading IDC’s market outlook to turn security demand into services with a defined scope, sustainable economics and verifiable outcomes.

Application Security · October 20, 2026 · 7 min read

API security: authorization is the real boundary of a multi-tenant SaaS

Turn OWASP API Security into architecture decisions, isolation tests and meaningful authorization metrics for SaaS platforms.

Security Operations · October 20, 2026 · 7 min read

MITRE ATT&CK: a colored matrix does not prove detection capability

Define defensive coverage through hypotheses, telemetry, authorized validation and metrics that preserve business context.

NIST · Governance · October 20, 2026 · 7 min read

NIST CSF 2.0: turning governance into decisions supported by evidence

Connect risk, ownership, testing and executive decisions with NIST CSF 2.0, using measurable outcomes and verifiable evidence.

CISA · Prioritization · October 20, 2026 · 7 min read

CVSS, EPSS and CISA KEV: deciding what to fix first

Combine severity, known exploitation, probability and asset context to build a defensible remediation queue and verify the outcome of each treatment.

Regulation · Banco Central · October 29, 2026 · 8 min read

Resolução CMN 5.274 and BCB 538: the annual penetration test your regulated client must now contract

What Resolução CMN 5.274 and BCB 538 require: an annual, independent, documented penetration test — and the work that creates for an MSP in Brazil.

Regulation · Banco Central · October 29, 2026 · 10 min read

Contracting a security supplier under Banco Central rules

Chapter III of Resolução CMN 4.893 and BCB 85: the eight checks before signing, the nine mandatory contract clauses, and the two deadlines people merge.

Regulation · Banco Central · October 29, 2026 · 8 min read

The annual cybersecurity report, and the date nobody watches

Art. 8º of Resolução CMN 4.893 and BCB 85 gained a fifth item. The deadline that decides whether it has content is not 31 March: it is 31 December.

Rules of Engagement template

A free twelve-clause Rules of Engagement template, the pre-flight checklist and the email to send your client before testing.

Open the template