Babar Khan Akhunzada leads security strategy, offensive operations. Babar has been featured in 25-Under-25 and has been to BlackHat, OWASP, BSides premiere conferences as a speaker.
PCI DSS
PCI DSS v4.0 is now fully in effect and as of March 31, 2025, every requirement is mandatory. The 51 "future-dated" requirements that were optional best practices when v4.0 was first published in March 2022 are now enforceable across all PCI DSS assessments. If your organisation
PCI DSS
If your bank, payment processor, or enterprise client has told you that you need PCI DSS compliance, and you have no idea what that means or whether it applies to you this guide is the starting point. PCI DSS is not a government regulation. It is not optional. It is
Most SAMA compliance failures are not technical. They happen because governance is undocumented, evidence is incomplete, or institutions discover during supervisory review that controls they believed were at Level 3 cannot be demonstrated to a regulator's standard. This SAMA compliance checklist is designed for CISOs, compliance managers, and
Penetration Testing
The most common question we get before a scoping call is some version of: "just tell me what a penetration test costs." The honest answer is that it depends on what you're testing and how deeply but the ranges are predictable, the variables are well-understood, and
SAMA
Most financial institutions in Saudi Arabia know they need to comply with SAMA. Fewer understand what compliance actually requires, how maturity is measured, how long it takes, and critically how it differs from other frameworks like ISO 27001 or NESA. This guide answers those questions directly. It covers what the
Red Teaming
The question comes up constantly when a CISO has done several rounds of penetration testing and starts wondering whether they're getting diminishing returns. The answer is that penetration testing and red teaming are not competing services they measure different things, serve different purposes, and the data on when
AI Maturity Assessment
Two things are happening simultaneously in 2026v organisations are deploying AI features faster than their governance can keep up, and regulators are finalising enforcement frameworks that carry penalties measured in millions of euros. The EU AI Act became fully enforceable for most operators on 2 August 2026. Finland activated the
Network Penetration Testing
Network penetration testing is the oldest category in offensive security and the one most frequently misscoped, mislabelled, or substituted with something cheaper that doesn't actually satisfy what an auditor or security programme needs. If you're preparing for a SOC 2 or ISO 27001 audit, evaluating whether
Cloud Penetration Testing
Most organisations that have pentested their web application haven't pentested their cloud environment. The two share an attack surface at the edges SSRF, exposed storage, misconfigured APIs but cloud infrastructure has vulnerabilities that a web app pentest scope doesn't touch: IAM privilege escalation, metadata service exploitation,
ISO 27001
ISO 27001 doesn't spell out "conduct a penetration test." What it does require is a structured programme of security evaluation that, in practice, auditors universally expect a pentest to satisfy. If your certification audit is approaching and you're uncertain whether a vulnerability scan is
LLM Security
Most organisations securing AI applications are doing it wrong not because they're careless, but because they're applying web application security thinking to a fundamentally different attack surface. A standard pentest doesn't test prompt injection. It doesn't test whether your RAG system leaks
If you're evaluating vendors for an AI agentic security assessment, you're likely asking: * What does OWASP Top 10 2026 mean for AI agents? * How is agentic AI security different from traditional web app security? * What should an AI agentic pen test actually include? * How do I