Brendan O'Leary

If Everything is a 9.8, Then Nothing Is

In the age of digitization, there's an imperative for companies, developers, and users to prioritize security. The Common Vulnerabilities and Exposures (CVE) system, and its associated CVSS scores, have played a pivotal role in helping the industry identify, categorize, and react to security issues. However, when every potential flaw is rated with a sky-high CVSS score, or when bugs are reported as CVEs even when they lack genuine exploitability, we find ourselves grappling with an alarming dilu

The Power of Nuclei Templates: A Universal Language of Vulnerabilities

Ever since joining ProjectDiscovery over nine months ago, I've been constantly surprised about many aspects of the state of the security industry today. Having lived through the open source revolution in software development and DevOps, I came to understand that a lot of what I learned and assumed from those revolutions aren't things to take for granted. Since joining PD's mission to Democratize Security, my conviction has only deepened that our community can revolutionize the security field. Th

Stop Pentesting. Start Programming.

As I mentioned in my blog about joining ProjectDiscovery, I came from mostly a DevOps background - I was just getting into software development as a career when the term "DevOps" was coined in 2009, almost 15 years ago. And so I got to see the problems that existed in getting code written and deployed to production in reliable, efficient, and repeatable ways. DevOps purports to solve a lot of those classic problems - by allowing developers and operators to work more closely together and work on

The best defense is a good offensive security program

The only constant is change. Perhaps nowhere is that more true than in software and security. Ever-evolving business needs and an ever-increasing speed of innovation have come together to cause an explosion in available surface area for attackers. This comes in many forms – with an ever-increasing list of tools that have access to various pieces of business data and an increasing number of devices and complexity of networks. But there's another vector whose complexity and breadth is also ever-in

Using PD tools to find my first subdomain takeover

Since joining PD in December, I've been learning a lot about our community and what it takes to be a modern security engineer. One of the biggest lessons I think I've learned is: 🤔To be a great defender, you have to think like an attacker Gone are the days when there were very separate teams—red and blue have even become “purple” in many organizations—doing security. And like the terminology or not, security continues to “shift left” and move into “DevSecOps.” While anyone trying to sell you

Brendan O'Leary — Page 2 — ProjectDiscovery Blog