2026-07-23 · Company
Why we started Faultline
A short note on the problems we want to help European teams fix first.
Notes
Blog
Technical write-ups. No product pitch, just the work.
2026-07-18 · AI red teaming
AI security yellow teams: why SaaS startups need both red and blue thinking
Yellow teams build the harnesses that make AI red teaming actually work, instead of just generating noise. What that means for SaaS teams evaluating AI security testing and build-versus-buy decisions.
2026-07-14 · AI red teaming
Orphaned AI agents: the SaaS AI agent security risk nobody tests for
Orphaned AI agents keep production access after their creators leave, and traditional audits miss them. How SaaS teams inventory agents, scope permissions, and test for prompt injection before attackers do.
2026-07-09 · Compliance
SOC 2 vs ISO 27001: What SaaS Startups Actually Need
A buyer-led framing of market expectations, not a standard-by-standard law lesson.
2026-07-07 · Application security
Citrix NetScaler vulnerability exploitation: why 24 hours is too long
CVE-2026-8451 was exploited within 24 hours of WatchTowr Labs publishing a PoC. Why the patch-deploy gap makes reactive security fail for authentication infrastructure, and what proactive testing finds first.
2026-07-04 · SaaS security
The AI exploit patching cycle: why your SaaS security testing cadence is obsolete
Apple just proved the AI exploit patching cycle is real. Why annual pentests are compliance theater, and what testing cadence actually keeps up with AI-accelerated attackers.
2026-06-25 · Application security
API security testing: what a SaaS team should expect
OWASP, abuse cases, and how to pair automated signals with a focused manual review.
2026-06-11 · SaaS security
Series A Security Checklist: What Investors Ask and How to Be Ready
What to prioritise in the 12-24 month window: identity, data, and vendor risk without boiling the ocean.
2026-06-03 · Pricing
How much does a startup pentest cost in Europe?
From pricing signals to what actually moves the number for B2B SaaS.
2026-05-27 · AI red teaming
AI agent identity security: why your SaaS product needs a new budget line
Most SaaS companies fund AI agent identity security from the wrong budget. Here is what it actually costs and how to plan for it.
2026-05-22 · AI red teaming
AI agent framework security: Claw Chain vulnerabilities and agentic AI risks
What the Claw Chain vulnerabilities in OpenClaw reveal about AI agent attack surfaces, and what SaaS teams should be testing before they ship.
2026-05-14 · Pentest process
What does a web app pentest include for a SaaS company?
Deliverables, common coverage, and the difference between tiers in plain language.
2026-04-30 · Pentest process
How Long Does a Startup Pentest Take?
Scoping, calendar time, and what the typical windows look like for SaaS teams.
2026-04-29 · Compliance
Do I Need a Pentest Before SOC 2?
What auditors expect, when a pentest is in scope, and what you can de-risk without a full test.
2026-04-28 · Application security
After CVE-2025-29927: the Next.js auth patterns that survived the patch
CVE-2025-29927 is patched. Three specific Next.js auth patterns it exposed are not. How to audit your own app for each one.