Notes on the velocity gap, continuous penetration testing, and shipping software faster without testing less.https://www.edgebreach.comhttps://www.edgebreach.com/blog-posts/attack-chains-low-severity-findings-criticalhttps://www.edgebreach.com/blog-posts/attack-chains-low-severity-findings-criticalSeverity scores rate findings one at a time. Attackers chain them. How low-severity findings combine into critical exploits, and how to test for it.Tue, 20 Oct 2026 00:00:00 GMThttps://www.edgebreach.com/blog-posts/soc-2-penetration-testing-requirementshttps://www.edgebreach.com/blog-posts/soc-2-penetration-testing-requirementsDoes SOC 2 require a penetration test? What the Trust Services Criteria actually say, what auditors expect in practice, and why Type 2 changes the question.Tue, 06 Oct 2026 00:00:00 GMThttps://www.edgebreach.com/blog-posts/95-percent-vulnerability-findings-false-positiveshttps://www.edgebreach.com/blog-posts/95-percent-vulnerability-findings-false-positivesWhat the research says about false positives, why scanners produce so much noise, and why the answer to faster shipping is continuous testing, not continuous scanning.Tue, 22 Sep 2026 00:00:00 GMThttps://www.edgebreach.com/blog-posts/alphabet-soup-security-tools-sast-dast-iasthttps://www.edgebreach.com/blog-posts/alphabet-soup-security-tools-sast-dast-iastSAST, DAST, IAST, SCA, and penetration testing explained in plain language: what each one looks at, what it catches, what it misses, and how they fit together.Tue, 08 Sep 2026 00:00:00 GMThttps://www.edgebreach.com/blog-posts/velocity-gap-annual-penetration-testinghttps://www.edgebreach.com/blog-posts/velocity-gap-annual-penetration-testingYour app changes daily; your pentest was months ago. Why annual penetration testing can't keep pace with AI-speed development, and what can.Tue, 14 Jul 2026 00:00:00 GMT