Writing · 59.3293°N · SE/EU

We write about AI and security testing.As plainly as we can.

What the law requires, what AI actually finds, and where the limits are. The sources sit at the foot of every piece, so you can check for yourself.

Position · Economics2026-08-25 · 6 min read

Two in three companies never test.Not because they do not want to.

One in three EU companies with ten or more employees ran any security test at all in 2024. The share that commissioned a penetration test is smaller than that. This is a piece about why the invoice looks the way it does, which part of the work actually costs money, and what happens to the price when a machine takes that part.

Read the article

Incident · Control2026-07-31 · 7 min read

The model thought it was a drill.The companies it broke into were real.

During July 2026, both OpenAI and Anthropic disclosed that their own models had escaped the test environment during security evaluations and attacked real systems. A malicious package was downloaded by fifteen real machines. This is the most important piece on this page, because it is about what keeps an agent contained.

Read the article

Regulation · SE/EU2026-07-31 · 7 min read

The rules tighten on 1 October.By then, know where your test runs.

Sweden's cybersecurity act took effect on 15 January 2026, and more rules follow on 1 October. Here is what the law actually requires, what it does not, and what really leaves the country when an AI helps test your application.

Read the article

Method · [ AI ] [ HUMAN ]2026-07-28 · 6 min read

Alone, the AI solves 21 percent.With a human beside it: 64.

In a single year, the share of security people willing to let AI run testing entirely on its own fell from 29 percent to 9. This is not opinion. The measurements point the same way, and the most advanced AI vendor in the world says the same about its own technology.

Read the article

Findings · CVE2026-07-24 · 7 min read

One pixel was enough.That is how an AI got into Bing.

SQLite, OpenSSL, FreeBSD and Microsoft's image search. A walk through what AI has actually found in software that millions of systems rely on. And in the same piece, the less pleasant half, because curl shut down its bounty programme in January over AI-generated noise.

Read the article

Vulnerabilities · A012026-07-21 · 6 min read

The tool finds nothing wrong.Customer A still sees B's invoices.

The most common serious flaw in web applications is the wrong person reaching the wrong thing. It is also the flaw automated tools are worst at finding, for a reason that is easy to grasp: the tool does not know what you meant the system to allow.

Read the article

Tempo · Exposure2026-07-17 · 6 min read

72 minutes to stolen data.Then the fix takes months.

In the fastest cases it takes 72 minutes from someone getting in until data is on its way out. Fixing a known flaw takes two to three months on average. That gap is not laziness, it is how the work is built. But part of it can be moved.

Read the article

Next step

Test it beforesomeone else does.

Free scoping. Fixed price before we start.

Request a quote hi@ravnsec.com

[AI] depth and pace[HUMAN] judgement and accountability[EU] residency in Sweden