https://polkaspots.com/security-due-diligence/blog/ Writing on offensive security testing, technical due diligence for investors, and why compliance certificates are not evidence of security. en-GB https://polkaspots.com/security-due-diligence/blog/what-diligence-should-tell-an-investment-committee/ https://polkaspots.com/security-due-diligence/blog/what-diligence-should-tell-an-investment-committee/ Thu, 06 Aug 2026 00:00:00 +0000 Not a severity distribution. Three things: does this change the price, does this change the plan, and what does it cost to fix. If the report cannot answer those, it was written for the wrong reader. due-diligence private-equity venture-capital m-and-a reporting https://polkaspots.com/security-due-diligence/blog/a-current-certificate-is-not-security/ https://polkaspots.com/security-due-diligence/blog/a-current-certificate-is-not-security/ Thu, 16 Jul 2026 00:00:00 +0000 We have found production databases on the open internet at companies holding current certifications. The certificate was not fraudulent. It was answering a different question from the one the buyer thought it answered. due-diligence iso-27001 compliance private-equity m-and-a https://polkaspots.com/security-due-diligence/blog/what-two-hours-of-testing-buys-you/ https://polkaspots.com/security-due-diligence/blog/what-two-hours-of-testing-buys-you/ Wed, 24 Jun 2026 00:00:00 +0000 A Flash Review is not a pentest and we do not pretend otherwise. Here is what fits in two hours, what does not, and why the constraint produces better results than it sounds like it should. penetration-testing flash-review methodology attack-surface