Predictable Usernames and Passwords | Field Notes, Issue 1
From the forge at Anvil Secure, welcome to Field Notes. Each installment takes a real finding from our work and follows it from first clue to impact, looking at the…
Demystifying Passkeys โ Under Attack (Whitepaper)
By Matteo Giordano A three-part series on passkeys for security engineers and offensive security specialists. You are reading the third part. Under the Hood: The Protocol. How passkey ceremonies work…
Introducing PQCDump: A Real Look at PQC Adoption
By Nicholas O'Shea Overview Quantum computing may one day break today's encryption standards, and new regulations are pushing companies to adopt "quantum-safe" methods now. Anvil Secure helps organizations navigate that…
Passkey Editor: a Burp Suite Extension for Attacking WebAuthn
By Matteo Giordano This tool, Passkey Editor, comes out of the same work as the Demystifying Passkeys Under the Hood series: The Protocol (ceremonies at the byte level), The Architecture,…
Internal AI Adoption Hackathon: What We Learned
By Antonios Papadopoulos Overview Anvil Secure's Technical Director, Antonios Papadopoulos, breaks down how the company ran a remote, company-wide AI Adoption Hackathon: two cohorts, dedicated build days, tracks drawn from…
Identifying and Chasing RCE in SAP’s CommonCryptoLib
By Tao Sauvage Overview In his third SAP blog post, Anvil Secure's Director of Research, Tao Sauvage, explores how a low-speed fuzzing target became a focused custom harness and why…
Finding Crown Jewels: Hunting Through 180,000 Ruby Gems
Overview Anvil CTO, Vincent Berg, pointed a homemade scanner at nearly 180,000 Ruby gems and started pulling on threads when he found something funny. What started as a simple experiment…
How We Use LLMs in Secure Code Review
By Tao Sauvage Overview This post explains how Anvil Secure uses LLMs as analyst-guided tools during secure code review engagements, not as autonomous reviewers. It covers the process-focused workflow, its…
How We Test AI: LLM & GenAI Security Methodology at Anvil Secure
By George Damiris Overview The company's methodology for testing LLM and GenAI services is based on industry best practices as well as hands-on experience testing AI agents and models across…